Calling a PDF ‘password-protected’ does not say what is protected. A file that asks for a secret before opening is different from one that opens freely but requests that viewers limit printing or copying.
Before sharing, decide whether you need to restrict reading or certain actions after reading. We also tested Toolit's opening-password behavior and content preservation with a controlled two-page PDF.
The decision in brief
Use it when people without the secret should not open the PDF content.
These request restrictions from compliant viewers, not the same thing as an opening password.
A password does not prove approval or prevent forwarding after the recipient opens the file.
We used the actual PDF engine and inspected the output
- 1
We created a two-page test PDF with text, vector drawing, a form field, and title metadata. Toolit's bundled QPDF WebAssembly engine applied AES-256 opening protection. We checked that empty and wrong passwords were rejected.
- 2
After unlocking with the correct password, code compared the page count, text streams, drawing commands, form value, and title with the source. We separately generated a PDF with no opening password but with a print restriction and checked its different open/permission behavior and the unlocked output.
- 3
The reproducible test is tests/pdf-password.test.mjs. It checks a controlled fixture, not every complex PDF, signature, or reader application.
Two different questions hide behind the word ‘password’
An opening password requires a secret before the file can be viewed. Print, edit, and copy permissions describe what a viewer should allow after the file is opened. Adobe describes document-opening and permissions passwords as different security types.
| Goal | Use | Remember |
|---|---|---|
| Limit who can open content | Opening password | It cannot stop a recipient from forwarding it |
| Ask normal viewers to limit printing or copying | Permission settings | Readers may enforce them differently |
| Prove who approved a document | Digital signature | Setting a password does not create one |
Print restrictions are not absolute copy prevention
PDF permission restrictions rely on viewer behavior. Software that can display the content already has access to its decrypted representation, so a permission flag cannot physically prevent every screenshot, forward, or extraction. QPDF's documentation explicitly distinguishes these restrictions from actual password protection.
Toolit adds an opening password but does not create new print/copy restrictions. Its removal mode makes a separate copy without the old password and restrictions when you know the needed password. Only change a document when authorized.
What did the two-page test show?
The protected copy rejected an empty or incorrect password. Unlocking with the correct value retained the fixture's two pages, tested text, vector drawing, form value, and title; the original bytes were unchanged.
That demonstrates more than simply taking pictures of pages, but it does not prove every font, attachment, or signature is preserved in every PDF. Open an important result in the actual reader you use.
Treat signatures and sensitive delivery separately
Writing a new PDF while adding or removing encryption can affect validation of an existing digital signature. Keep the signed original and use the issuing or signing application when legal or organizational validation matters.
Even with an opening password, check recipients and storage locations. Avoid sending the file and secret together in a public message. A password is an access gate, not full control over the copy after delivery.
Official documentation used for this analysis
Decide whether you are controlling opening or later actions
Choose an opening password to limit who can read the file. Printing/copying restrictions and digital signatures are separate features for different goals. Treating all three as ‘a PDF password’ can leave the real need unmet.
Our controlled test verified Toolit's opening-password round trip and selected document contents, not universal compatibility. Keep the original, confirm your authority, and review the result in a real PDF reader.