Encryption and password strength are separate
AES-256 is a strong encryption standard, but the practical protection of a file still depends on the password. A short predictable password can be attacked far more easily than a long random one.
Use unique credentials and avoid personal information that a recipient or attacker could guess.
Protection ends after authorized access
Once a recipient legitimately opens a PDF, they can usually view the information on their screen and may be able to take screenshots or otherwise reproduce it. Encryption controls access to the encrypted file, not every action after viewing.
For highly controlled information, use a document-management system with identity, access logging and revocation rather than relying only on an attachment password.
Compatibility matters
Very old PDF readers may not support newer encryption modes correctly. Test the protected file in software representative of the recipient's environment if compatibility is important.
Keep the encryption process local when possible so the unprotected source and password do not need to be transmitted to a conversion service.
Separate opening protection from what a recipient can do
Pageivo uses AES-256 for the protected copy and allows printing and form filling in its current settings. Its six-character interface minimum is merely input validation. Use a long, unique password generated by a password manager; Pageivo cannot recover it.
The public Lab password is published so anyone can inspect a fictional fixture. It offers no secrecy and must not be reused. Testing that fixture demonstrates one implementation and reader check, not certification of your file or your delivery channel.
| Threat or requirement | What an attachment password changes |
|---|---|
| Someone receives the attachment without its password | A compatible reader requests the opening password |
| Recipient forwards the password too | The next person can also open the file |
| Recipient takes screenshots | Encryption does not prevent this after opening |
| Need access revocation or audit logs | Use an approved managed system |
Delivery remains part of the risk
A separate password channel reduces reliance on one message but does not guarantee that either device or account is secure. Follow the recipient’s approved process for sensitive records; avoid absolute security claims.
- Keep a secure original and record the unique password appropriately.
- Encrypt only the final reviewed file.
- Close any open preview and test in a fresh reader session with a wrong and then the correct password.
- After opening, check page count and required form behavior.
Use the related Pageivo tool
Secure a PDF with a password. The operation runs in your browser and does not require an account.