The short answer: use a long, unique passphrase (16+ characters), encrypt with AES-256, set a separate owner password for permissions, share the password through a different channel than the file, and store it in a password manager. The password is only as strong as the habits around it.
Length beats complexity
Security research has converged on an unfashionable truth: a long password beats a "complex" one. Tr7$kQ9! (8 characters of keyboard gymnastics) falls to brute force far sooner than correct horse battery staple-style passphrases — and the passphrase is one you can actually remember and type correctly on a phone.
For PDFs specifically, aim for 16+ characters: four or five random words, a memorable sentence with a number in it, anything long. PDF password cracking is an offline attack — the attacker gets unlimited guesses — so every extra character multiplies their work enormously.
Unique per document
This is the practice people skip, and it's the one that matters most in the real world. A PDF password travels with the file: it goes in the email, gets spoken on calls, gets written on sticky notes. The moment a password is shared, it's compromised by design — that's the point of sharing it.
So never reuse a personal password (email, banking, anything) as a PDF password. Generate a fresh one per sensitive document. A password generator makes this painless — and PDFEdit's protect tool sits right next to it in the same workflow.
AES-256, not RC4
Not all PDF encryption is equal. The PDF format supports several encryption algorithms, and the old ones are genuinely weak:
- AES-256 — the modern standard. This is what you want, and it's the default in PDFEdit's protect tool.
- RC4 — a legacy algorithm with known weaknesses, kept around for compatibility with ancient PDF readers. Only use it if the recipient is stuck on software from another era — and then question the whole arrangement.
Algorithm choice is a dropdown in most tools. It takes two seconds to check, and it's the difference between real encryption and theater.
User password vs. owner password
PDFs actually have two passwords, and they do different jobs:
- The user (open) password locks the door — nobody reads the file without it.
- The owner (permissions) password sets the house rules — printing allowed? copying allowed? — for people who can open the file.
Best practice: set both, and make them different. The user password goes to your recipients; the owner password stays with you. That way recipients can read the document but can't strip your "no copying" restriction without the second password. (Honest caveat: permission restrictions are honored by legitimate readers but aren't cryptographic barriers — determined users can bypass them. Treat them as policy enforcement, not vault doors.)
Share the password separately from the file
The single most common password failure isn't weakness — it's delivery. The password sitting in the same email as the PDF attachment protects against exactly nobody who can read email.
Send the file one way and the password another: PDF by email, password by text message. PDF by file share, password by phone call. It doesn't need to be elaborate — just a different channel. For teams, a shared password manager with secure sharing beats every ad-hoc method.
Store it, or lose the file
There is no "forgot password" link on a PDF. Lose the password and the file is a paperweight — AES-256 doesn't care that you're the owner. Every PDF password goes into a password manager the moment it's created, full stop. If your organization handles sensitive PDFs regularly, this isn't advice, it's policy.
Passphrases that actually work
Theory is nice; here are patterns you can use today. The goal is length plus memorability, generated fresh per document:
- Four random words + a number:
candle orbit mango 47(20 characters). Genuinely random words beat "clever" phrases. - A sentence with substitutions:
My accountant files in March! 2026(34 characters). Personal, long, typable. - Generator output: PDFEdit's password generator produces long random strings on demand — ideal when memorability doesn't matter because the password goes straight into a password manager.
What not to use: the company name, the project name, the year alone, "password123" variants, or anything printed elsewhere in the document. Attackers try the obvious first — and the obvious includes everything related to the file itself.
When a PDF password leaks
It happens: the password went in the same email as the file, a recipient forwarded both, someone wrote it on a shared doc. Don't panic — respond:
- Assess exposure. Who has the file + password combo? If it's one trusted recipient, the risk is low. If it went to a mailing list, assume it's public.
- Re-protect with a fresh password. Unlock your master copy (you have the password), then protect it again with a brand-new, unique password. Never "re-secure" by reusing the leaked password.
- Fix the distribution, not just the file. The leak was a process failure — password in the same email, probably. Change the process: separate channels, password manager sharing, or a secure file-share link with its own access control.
- Consider whether the content is still shareable. If the leaked file contained information that must never have reached the wider audience, a new password doesn't un-send the old file. That's a redaction conversation, not a password conversation.
Passwords are revokable only before distribution. After that, you're managing exposure — which is why the checklist puts redaction (permanent) before protection (revokable).
Do it with PDFEdit
Protect a PDF with AES-256 encryption, a user password, an optional separate owner password, and granular permissions — free, in your browser, the file never uploaded. Pair it with our unlock guide for the receiving end, and the security checklist for the full picture.
