PDF Security Tips That Actually Matter

By SwiftPDF Team · Updated 2026-09-06 · 3 min read

PDFs feel safe. They're the format of contracts, medical records and financial statements — so they must be secure, right? The truth is more nuanced: PDFs can be well protected, but most 'security' people apply is theater, and the real risks are the ones nobody checks.

Here is what genuinely protects a PDF, what doesn't, and the hidden leaks — like metadata — that undo everything else.

Start with your threat model

Security without a threat model is guesswork. Are you stopping casual snooping on a shared computer? Preventing forwarding of a confidential report? Meeting a compliance checkbox? A password stops the curious; it won't stop a determined attacker with time and tools. Match the measure to the adversary.

Use open passwords with AES-256 — and make them strong

A real open password (required to view the document) with AES-256 encryption is solid protection. The weak link is almost always the password itself: 'Contract2026' falls to dictionary attacks in seconds. Use a password manager to generate something long and random, and share it through a different channel than the file — never in the same email.

Beware the permissions password trap: the 'restrict printing/editing' password is enforced by reader software, not cryptography. Many free tools ignore it entirely. It stops honest people and nobody else — never rely on it for real confidentiality.

Redact properly — black boxes lie

The most dangerous PDF mistake: drawing black rectangles over sensitive text. The text is still underneath — anyone can select, copy or delete the rectangle to reveal it. Proper redaction removes the text from the file's content stream entirely.

Use a real redaction tool (Acrobat Pro's Redact, or PDF editing suites with redaction features), apply the redactions, save, and then verify by trying to select the text and searching the document for the redacted terms.

Scrub the metadata

PDFs carry hidden metadata: author names, the software that created them, sometimes edit history and tracked changes. A 'clean' contract can leak who drafted it, when, and on what machine. Before sharing sensitive PDFs externally, strip document metadata — free browser compressors that rewrite the file typically clear the standard metadata fields as a side effect.

What doesn't actually protect you

• Watermarks marked 'Confidential' — they deter honest people; they don't stop copying
• Permissions passwords — ignored by many readers, as noted above
• Converting to images inside the PDF — OCR defeats this in seconds
• Security through obscurity — odd filenames and hidden folders aren't protection

Share securely, not just encrypt

Encryption protects the file; sharing practices protect the workflow. Prefer expiring share links over permanent email attachments, confirm recipient addresses before sending sensitive files, and remember that every copy you send is a copy you no longer control.

Related guides

Frequently asked questions