Keep Confidential PDFs Secure

A password on a document is a strong lock, but security is never just one lock, it's a set of habits. Confidential PDFs leak far more often through carelessness than through cracked encryption: a file left on a shared drive, a password taped to the same email, a copy forgotten in a downloads folder. The steps to keep sensitive documents genuinely secure, start to finish.

Start with real encryption

Everything else builds on this foundation. Before a confidential PDF goes anywhere, lock it with a genuine open password using the Protect PDF tool. Real AES encryption means the file can't be opened without the password in any reader, a flag or an overlay that some apps ignore is not enough.

I wrote that tool, so let me be specific about what it does and, more importantly, what it can't do. It uses @cantoo/pdf-lib's encrypt() to apply AES encryption with your password as the document's user password, all inside your browser tab. The file and the password are held in memory and never transmitted. There is no server to leak them from, and nothing for me to hand over if someone asked.

The honest limit worth knowing: a PDF carries two distinct kinds of protection, and only one of them is cryptography.

• The open password is real. The document's contents are genuinely encrypted. Without the password there is nothing to read, in any reader, ever. This is the protection you're actually relying on.
• The permission flags are not. "No printing", "no copying", "no editing" are settings the tool writes into the file (our default is view-only) but they're enforced by conforming readers choosing to honour them, not by maths. A determined person with the right software can ignore them. Treat permissions as a courtesy to well-behaved apps, never as a barrier against someone who doesn't want to behave.

One deliberate exception in our defaults: contentAccessibility stays enabled, so screen readers can still read the document aloud to someone who needs them. Locking a file shouldn't lock out the people who rely on assistive technology.

Treat the password like a key, not a note

An encrypted file with a carelessly handled password is barely protected at all. So:

• Store it in a password manager, not a sticky note or a text file named passwords.txt.
• Never send it alongside the file. Use a separate channel like a call or a text.
• Use a unique password per document where it matters, so one leak doesn't unlock everything.
• Prefer a long passphrase over a short, cryptic string. It's stronger and easier to remember.

Mind the copies you leave behind

The original, unencrypted file usually still exists after you've made a protected version. That's fine (you need a backup) but know where those copies live:

• Clear out sensitive originals from shared or synced folders (cloud drives, team spaces) unless they belong there.
• Empty your downloads folder of confidential files you no longer need.
• Remember that email drafts and sent items keep attachments too.

Keep exactly one deliberate, well-protected backup of the original, and remove the stray copies.

Limit who can do what

An open password controls who can open a file. For extra confidence with genuinely sensitive material:

• Share the document with only the people who need it, the smallest audience possible.
• Set expectations that the file shouldn't be forwarded or re-shared.
• When a project ends, ask collaborators to delete their copies.

Technology enforces the lock. Agreed practice covers the human gaps around it.

Have a plan for lost passwords

Real encryption has no back door, which is exactly why it works, and exactly why a forgotten password means a permanently unopenable file. Protect yourself:

• Always keep a safe, unencrypted master copy of the original.
• Record the password the moment you set it.
• Note who else holds the password, so access doesn't vanish if one person leaves.

If you still have the password and simply want the prompt gone from a document you own (a file you're about to print in bulk, say) Unlock PDF opens it with pdf.js and rebuilds a clean, unencrypted copy. It's a convenience for your own documents, not a way into someone else's: without the password there is nothing to open.

A simple routine

For any confidential PDF, make this second nature:

1. Encrypt it with a strong, unique password.
2. Store the password in a manager.
3. Share the file and the password through separate channels.
4. Clean up stray unencrypted copies.
5. Keep one protected backup of the original.

Run that five-step loop a few times and it stops being a checklist and becomes a reflex, which is the real goal, because the documents that leak are almost never the ones someone thought carefully about. Protect a file now and let step one become muscle memory. For the mechanics of choosing and setting the password itself, see how to password protect a PDF. For the specific case of sending one by email, encrypt a PDF before emailing it covers the separate-channel habit in more depth.

Sources

• NIST SP 800-63B (Digital Identity Guidelines, Authenticator Requirements), why length beats forced complexity
• PDF 2.0 (ISO 32000-2) overview (PDF Association): where encryption and permission handlers are specified
• pdf-lib, the library our protect/unlock tools build on
• Advanced Encryption Standard (Wikipedia)