How to protect, password-lock, and truly redact a PDF

PDF security has three different jobs:

• control who can open the file
• discourage copying, editing, or printing
• permanently remove information

They need different tools.

Decide what you are protecting against

If the file contains payroll, health, legal, identity, customer, or financial information, follow your organization's required system first. A password on an email attachment may not be the approved method.

For ordinary confidential sharing, a named-person cloud link or secure portal is often easier to revoke than an attachment.

Add a password to open the PDF

In a full PDF security tool, choose Protect, Encrypt, or Protect with password, then set a document-open password.

Use a long, unique password. Send the password through a different channel—for example, email the PDF and text the password.

Adobe Acrobat distinguishes:

• a document open password, required to view the PDF
• a permissions password, used to restrict actions such as editing, copying, or printing

Its password security overview explains the difference.

Do not forget the password. Strong PDF encryption is meant to resist bypassing, including by you.

Understand permission restrictions

“Do not print” and “do not copy” settings can discourage casual actions, but they do not replace access control, contracts, or good judgment. A person who can see information may still photograph or retype it.

Also remember: making a document a PDF does not automatically make it uneditable.

Redact information permanently

Covering a name with a black rectangle is not redaction. The original text may remain underneath.

Use a real Redact tool:

1. Save a working copy.
2. Mark text, images, headers, footers, or repeated patterns for redaction.
3. Review every marked area.
4. Choose Apply redactions.
5. Use the tool's option to remove hidden information or sanitize the document when appropriate.
6. Save as a new file.

Test the redaction

On the finished copy:

1. Search for the removed name, number, or phrase.
2. Try to select and copy around the blacked-out area.
3. Check comments, attachments, form fields, layers, bookmarks, and document properties.
4. Open the file in a second viewer.
5. Verify that no neighboring information was removed by mistake.

Do not redact the only copy. Redaction is intentionally hard to reverse.

Remove hidden information

A PDF may carry:

• author and company metadata
• comments and tracked review notes
• attached files
• hidden layers
• form responses
• scripts or actions
• text outside the visible crop

Use Remove hidden information, Sanitize, or your organization's approved cleaning process before external release when the stakes are high.

Share the protected file

Tell the recipient:

• which app or browser to use if needed
• how the password will arrive
• whether printing or editing is restricted
• when the link or password expires

Security that locks out the intended reader is not finished. Test the exact protected copy before sending it.