Why most 'protected' PDFs aren't
It's surprisingly common for people to share passport scans, signed contracts, and salary slips as plain PDFs — over email, over messaging apps, or as attachments to forms. If the email account or messaging history is compromised, every one of those documents is exposed.
Some users add a 'protection' that's just an open-password set by a free online tool. That's better than nothing, but the password is often weak, the encryption is sometimes the legacy 40-bit cipher, and the tool keeps your file long enough to be a liability of its own.
Real PDF security means strong encryption (AES-256), strong passwords, and — when needed — separating editing/printing permissions from open access. It should also be done on-device, because the moment you upload a sensitive document to a web tool, you've already lost the privacy battle.
Security tools that match the threat model
Password protection
Set a password to open the document. The PDF can't be viewed without it.
AES-256 encryption
Strong modern encryption, the standard used by enterprise systems.
Restrict copy and print
Allow viewing but block copying text, printing, or extracting pages.
Redaction
Permanently black out names, account numbers, or signatures before sharing.
Watermarks
Add a 'confidential' or recipient-specific watermark to discourage forwarding.
Password sharing tips
Built-in guidance on sharing passwords via a separate channel from the document itself.
How to protect a PDF
- 1
Open the PDF
Import the document into PDF Editor from Files or any cloud drive.
- 2
Tap Protect
Find it under the document tools menu. Pick the level of protection you need.
- 3
Set the password
Use a strong password — at least 12 characters, mix of letters, numbers, and symbols.
- 4
(Optional) Choose restrictions
Allow or block printing, copying, and editing. Useful for shared but read-only documents.
- 5
Save the protected copy
Save as a new file so the original stays accessible if you forget the password.
Protecting sensitive documents on the go
Most security mistakes happen when you're rushed. Phone-based protection means you can lock down a contract before sending it from the airport, or protect a payroll PDF before sharing it with a contractor — without finding a desktop.
Frequently asked questions
- AES-256, the modern standard. Avoid older 40-bit and 128-bit RC4 encryption — they're trivially broken.
- There's no backdoor. Strong encryption means the document is unrecoverable without the password. Store it in a password manager.
- Use a different channel than the document itself — text the password if you emailed the PDF, or use a password manager's secure sharing feature.
- Yes. Proper redaction removes the underlying text, not just covers it visually. Even copy-pasting from the redacted PDF won't reveal the original.
- Yes. They're independent and can be applied together.