PDF supports two kinds of password, and mixing them up is the most common mistake people make when protecting a document.
The open password (user password)
This encrypts the whole file. Without the password, the content cannot be read at all. Protect PDF uses AES-256 encryption, the strongest the PDF standard offers. This is the one you want for confidential documents.
The permissions password (owner password)
This lets anyone open the file but asks viewers not to allow printing, copying or editing. Reputable readers honor these flags, but they are not real security: plenty of software ignores them. Treat permissions as a polite request, not a lock.
Choosing a good password
- Use a long passphrase of four or more random words.
- Send the password through a different channel from the file, for example by text message when the file goes by email.
- Keep a copy in a password manager. A forgotten AES-256 password cannot be recovered.