Folia Tools
PDF passwords explained: two passwords, one real lock, and a lot of advisory flags
PDF encryption has two passwords with very different powers, and a set of permission flags that are not enforcement at all. Most confusion about locked PDFs comes from mixing them up.
The user password and the owner password
A PDF can carry two passwords, and they do different jobs. The user password — also called the open password — is required to decrypt the file at all. Without it the content streams are unreadable bytes, and no reader can display anything. This is real cryptography and it is the only thing in the specification that genuinely stops someone.
The owner password is the permissions password. A file can have an owner password and no user password, which is the arrangement that causes all the trouble: the document opens for anyone, with no prompt, and the owner password only governs whether the reader is supposed to allow printing, copying or editing.
That word "supposed" is the whole story. The file is decrypted — every reader has already read it in full in order to display it. Whether it then greys out the print button is a decision the reader makes voluntarily.
Permission flags bind only software that chooses to be bound
The tick-boxes that prevent printing, copying and editing set flags carried inside the file. Acrobat honours them. Most mainstream readers honour them. Nothing compels any of them to, and software that ignores them is not breaking anything — the content was already decrypted before the flag was read.
Two of these flags have consequences people do not anticipate. Preventing editing also switches off form filling, annotating and page assembly, so a form you have locked against editing is a form nobody can fill in. Preventing copying also switches off the text extraction that screen readers rely on, which makes the document inaccessible to blind readers while doing essentially nothing to a determined copier.
Protect PDF uses the one password you type as both the open password and the owner password. That is deliberate and worth understanding: it means anyone you hand the file to can clear the restrictions as well as open it. Treat the password as the real lock and the flags as instructions to well-behaved software, because that is exactly what they are.
Why the version number in the header decides your cipher
This one is genuinely obscure and it matters. PDF encryption has gone through several generations — 40-bit RC4, 128-bit RC4, AES-128, and AES-256 — and which one a library picks is usually driven by the version number declared in the PDF's own header.
A file that declares itself version 1.4 predates AES in the specification, so a conforming library encrypting it will reach for RC4, a cipher broken long ago and unfit for anything you would bother to encrypt. And 1.4 is exactly what a great many Word and LibreOffice exports declare, years after anyone needed them to.
Folia rewrites the header to 1.7 extension level 3 before encrypting, so every file leaves with AES-256 regardless of what it arrived as. Nothing is re-rendered and nothing is re-compressed on the way through — the pages, fonts and images are the ones you started with, simply encrypted properly. If you use a different tool, it is worth checking what your files actually get, because the default is frequently determined by a number in a header nobody has looked at since 2003.
Encrypt last, after everything else is done
An encrypted PDF cannot be parsed, so encryption is a door that closes on your own tooling as well as on other people. Compress PDF, OCR PDF and every converter on this site refuse an encrypted file and name Unlock PDF as the fix. Protect PDF will not take one either — feeding an already-protected file back in fails rather than re-encrypting it.
So the order is: do all the visible work first — watermark, page numbers, redaction, compression, signing — and encrypt the finished document as the final step. To change a password, unlock with the old one and protect again with the new one.
Unlocking is a decrypt and a re-save: your browser opens the document with the password you supply, which decrypts every stream inside it, and writes the result out with no encryption dictionary at all. The permission flags go with it, because they only ever existed inside the encryption that has just been removed. Nothing is re-rendered, so pages, fonts, images, form fields, annotations and bookmarks carry through exactly as they were.
Then remember what is now sitting on your disk: an unprotected copy of a document that was protected for a reason. Do the work, keep it local, and re-encrypt before it goes anywhere.
What encryption does not do
It does not conceal anything from the people you give the password to. Everyone who can open the file sees all of it, including whatever a black rectangle appears to be covering. If a name or a figure must not reach the reader at all, it has to come out of the document with Redact PDF before encryption is even relevant.
It does not prove who wrote the document or detect whether it has been altered. That is a digital signature — a cryptographic hash of the file bound to a certificate — which is a different mechanism entirely. A drawn or typed signature added with Sign PDF is a picture of a signature: it is drawn into the page so no reader can drag it off or delete it, but nothing in the file records that the paragraph above it has not been rewritten since.
And it does not survive conversion. Convert an unlocked copy to Word and the .docx has no encryption at all. Anything you send onward is only as protected as the format you sent it in.
Questions
Someone sent me a PDF I can open but not print. Is that encrypted?
Yes — it has an owner password and no user password. The file is encrypted, your reader decrypted it automatically with an empty user password, and it is now voluntarily honouring a flag that asks it not to print. Unlock PDF removes the encryption dictionary and the flags with it.
Can Folia remove a password I do not know?
No. Unlock PDF requires the password; it decrypts with the key you supply and re-saves. There is no cracking, no recovery and no bypass. A file whose open password is genuinely lost and is encrypted with AES-256 is not recoverable by any practical means, which is the point of encrypting it.
Why did my converter refuse my password-protected file?
Because it cannot parse it. The content streams are encrypted, so there is nothing for a converter to read until the file is decrypted. Nothing on the site prompts for a password mid-job — unlock once, work on the open copy, and re-protect the finished document.
Is AES-256 on a PDF actually secure?
The cipher is. The weak points are elsewhere: a guessable password, the same password used as both open and owner password, and the fact that anyone you legitimately give it to can then do anything they like with the contents. Encryption solves distribution, not disclosure.
Does protecting a PDF change the file itself?
Only its header and its encryption dictionary. Folia rewrites the version to 1.7 extension level 3 so AES-256 is used, then encrypts. Pages, fonts and images are not re-rendered or re-compressed, so the document you get back is the document you put in.