PDF passwords, protection, and redaction: what each one actually does

Why this is worth getting right

"Secure the PDF" can mean three genuinely different things, and people reach for the wrong one constantly — usually because all three sound like they do the same job. Password-protecting a document, encrypting it, and redacting part of its content each defend against a different threat. Confusing them is exactly how a supposedly-redacted document ends up with the black boxes lifted off in someone else's PDF reader, or a "protected" file that anyone with the free version of a PDF tool can strip in seconds.

A password (Protect PDF) controls who can open it

Protect PDF adds a password requirement to opening the file, using standard PDF encryption — the same mechanism Acrobat and most readers rely on. This is genuinely useful for casual protection — stopping someone who finds the file on a shared drive or a lost laptop from opening it without effort. It's worth being specific about the strength, though: the widely-compatible encryption standard PDFs have supported for decades (RC4-40) is legacy-grade by modern standards, which is exactly why it works in every reader but isn't the right choice for anything genuinely high-stakes — financial records, legal filings, medical files. Treat a password as a speed bump for casual access, not a vault door against a determined attacker; for material that really can't leak, pair it with a dedicated tool built around a modern cipher.

Removing a password (Unlock PDF) only works on your own password

This is worth stating plainly because it comes up often: Unlock PDF removes protection using a password you already know and enter yourself. It has no ability to guess, crack, or recover a password you've lost, and it isn't trying to — that would be a fundamentally different (and much more dangerous) kind of tool. If you've genuinely forgotten a password, the only reliable path is whoever originally set it, or the software used to create the file.

Redaction (Redact PDF) hides content — with one important catch

Redaction is for a different problem entirely: not "who can open this file" but "this one page has a social security number on it that nobody should see." Redact PDF draws an opaque black box over the region you select. Here's the catch that trips people up: drawing a black box on top of content is a visual change, not automatically a data-removal one. The pixels underneath can still exist in the file's data unless the file is subsequently flattened — re-saved so the covered layer and the content beneath it are merged into one, rather than sitting as separate objects a determined reader could peel apart. In practice: redact to cover what needs hiding, then flatten (running the result through Compress PDF re-saves and flattens the file as a side effect) before sending anything sensitive onward. Skipping that second step is the single most common way redaction fails in the real world, and it has caused real, publicly documented leaks — this isn't a hypothetical.

Putting it together

For most everyday needs — sending a personal document, sharing something you'd rather a stranger not casually open — a password from Protect PDF is enough. For anything containing information that would genuinely cause harm if exposed (financial account numbers, medical details, legal case information), redact first, then flatten by re-saving, and consider adding a password on top for transit. None of these tools, alone or combined, substitute for judgment about who you're sending a file to in the first place — but knowing which guarantee each one actually gives you is what lets you make that judgment correctly instead of by assumption.