PDF user password vs owner password: what each one really protects

The 2 passwords in 1 picture

A protected PDF has 2 separate doors, and most confusion comes from thinking there is only 1.

The user password turns the file into ciphertext. getPDF’s Protect PDF uses AES-256 at revision 6, the scheme of the PDF 2.0 standard (ISO 32000-2): every piece of text, every image and every font in the file is encrypted with a random 256-bit key, and that key is only recoverable with the password. Open our protected test invoice in a text editor and the words “Invoice total” are nowhere in the bytes.

The owner password sets 4 groups of permissions in getPDF: Print, Copy text, Change, and Annotate and fill. A file with only an owner password is technically encrypted too, but with an empty password to open, so every viewer can decrypt it without asking you. The encryption there exists only to carry the permission flags. We checked this on a file with everything denied: it opened without a password, and its text read out in full.

One permission getPDF never takes away: text extraction for accessibility. Unticking Copy text asks viewers to block copying, but a screen reader may still read the file aloud, because PDF 2.0 deprecates restricting that and the tool always leaves it on.

Why a PDF opens without asking and still refuses to print

That is owner-only protection, and it is common: statements, certificates and published reports often carry it. The sender set an owner password and ticked off printing or copying, but set no password to open.

Your viewer opens the file, reads the flags, and greys out Print or blocks text selection. Nothing is broken and nothing is encrypted against you. If you hold the file legitimately, see the fix when a PDF will not print or copy.

The uncomfortable fact: permissions are a request

The PDF format leaves the enforcement of permissions to each viewer. Some honour them, some do not, and you cannot tell from the sending side which one your reader uses. What we found, checked on 11 October 2026:

Program	Honours “no printing” and “no copying”?	Source
Chrome’s built-in PDF viewer	Yes, it checks the print and copy flags	Chromium source, pdf/pdfium/pdfium_permissions.cc
Firefox’s built-in PDF viewer	No, not by default: the pdfjs.enablePermissions setting is off unless an administrator turns it on	pdf.js source, web/app_options.js; Firefox policy docs
getPDF’s own tools	No. Merge, Compress and PDF to Text all ran on our test file with every permission denied, without asking for anything	Measured on 11 October 2026

That last row is deliberate honesty: this site’s tools read the file the way most libraries do. Merge then says the result has no protection, and Compress adds “Protect it again if you need one”. Unlock PDF removes owner-only restrictions in 1 click, with no password, because none is needed to decrypt the file.

So an owner password stops an honest colleague using Chrome from printing by accident. It does not stop anyone who wants the content.

The trap: the same password for both

In getPDF’s options panel, the Owner password field says “Empty means the same as above, and then anyone who can open the file can lift them.” That default suits most people who only want a password to open. But if you also untick permissions, the hint is the whole story: when both passwords are the same, whoever types it is the owner, and the owner may do everything.

We measured it: a file protected with 1 password and all 4 permissions unticked reports print, copy, change and annotate as allowed once that password opens it. The tool now says so on the result too: “The owner password is the same as the password to open, so anyone who can open the file can also lift the restrictions.” The restrictions only bind readers who open the file with a different password than the owner’s. So when you restrict, always type a separate owner password and keep it to yourself.

What to set when

Your goal	Set this	Leave this
Nobody without the password may read it	Password to open	Owner password empty (same as above)
Recipients read it, but should not print or copy	A different Owner password, permissions unticked	Password to open empty
Recipients need a password, and should not print	Password to open, plus a different Owner password, permissions unticked	Nothing
The document must provably not change	A digital signature, not a password	Permissions alone

The first row is real protection. The others add a request on top. For what the encryption itself can withstand, see how strong PDF encryption is.

Doing it in getPDF

1. Open Protect PDF and drop the file. It opens in a worker in your tab; nothing is uploaded.
2. Under Options, type a Password to open if the file must stay private.
3. If you want restrictions, type a different Owner password, then untick what readers may not do under Allow: Print, Copy text, Change, Annotate and fill.
4. Press Protect. The result is opened again with your password to check it, then Download PDF saves yourfile-protected.pdf.

To see what an existing file carries, drop it into Inspect. If it asks for a password, it has a user password. If it opens, the Security section lists “Encrypted: yes, revision 6” (or another revision) and whether printing, copying, changes, and notes and form filling are allowed. Inspect reads the file and changes nothing.

Inspect PDFFonts, images, metadata, why it is big. Free, runs on your device.Open

The honest part

• A user password protects the file at rest and in transit. Once the right person opens it, they can save, forward or print it as they like.
• An owner password never stops a screenshot, a phone camera, or a tool that ignores flags, including ours.
• A weak password to open undoes strong encryption. 4 or 5 random words beat a short clever one.
• getPDF does not recover forgotten passwords. Unlock needs the password you know; see what is possible if you forgot it.

The full map of passwords, redaction and metadata is in the PDF privacy and protection guide.