PDF security and privacy: controlling what a document reveals

Access and disclosure are different problems

Encryption decides who can open a document. It does nothing about what the document says once opened. A password-protected file that still has an unredacted account number leaks that number to every person given the password. Redaction and metadata removal decide what the document contains. They do nothing about who can open it. Sensitive documents usually need both, applied in the right order: first make sure the content is safe to share with the intended readers, then control who those readers are. Thinking of the two separately is the simplest way to avoid the classic mistakes, which almost always involve trusting one kind of protection to do the job of the other.

Passwords and encryption

Protect PDF encrypts a document with AES-256, the strongest method in the PDF standard, and requires the password to open it. The same password controls editing, and no printing or copying restrictions are added, so anyone with the password has full access. The password is the weak point: use a passphrase of several unrelated words, and send it through a different channel from the file. Unlock PDF reverses protection when you know the password, or removes editing restrictions from files that open without one. It can't recover lost passwords, and it should only be used on documents you're authorized to access, as the terms of use require.

Sharing with a link instead of a file

An attachment can be kept and forwarded forever. Share PDF Link stores a file encrypted with a key that exists only in the link, and deletes it when the link expires, after seven days at most. You can add a password, allow viewing only so the PDF itself is never sent, see when the link was opened, and turn it off early. A link can't stop screenshots or someone passing the link on, so still remove what readers don't need before you share.

Redaction done properly

Covering text with a black rectangle leaves the words in the file, where they can be selected, copied or found by search. Redact PDF applies real redactions: you mark areas as percentages of the page, and the text inside each area is deleted and the image pixels beneath are blanked before black is drawn in. Always verify by searching the output for the removed words. Two other tools are often mistaken for redaction and aren't: cropping hides content outside the page box but keeps it in the file, and flattening turns pages into images but keeps everything visible. Redact first, then flatten or protect as needed.

Hidden information: metadata and more

Every PDF can carry an author name, the software that made it, the dates it was created and changed, and an old title or keywords. These are stored in the document's information fields and often copied into an XMP block too. Remove Metadata clears both. Other hidden details need other tools. Comments and form values stay until you flatten, and attachments and bookmarks remain. Embedded photos can hold their own camera data or the uncropped version of an image, which Extract Images shows you. For documents you publish, replace leftovers with a clear title using View / Edit Metadata. The PDF privacy guide goes through each hiding place.

Files from outside: scripts and hidden content

A PDF can carry JavaScript, actions that run when it opens, attached files and layers you can't see. That's how harmful PDFs try to reach a computer, and how hidden drafts and notes leak out. PDF Sanitizer scans a file without running anything in it, shows what it found, and saves a clean copy without the parts you pick, along with a before and after report. It isn't a virus scan, but it removes what most PDF attacks need. Clean files from unknown senders before opening them, and clean your own files before publishing them.

Knowing what changed

When a contract, policy or drawing comes back revised, Compare PDF shows where it differs from your version. You can view both side by side with scrolling kept in step, lay one over the other, or see only the differences, and every changed area is boxed. Added, removed and moved text is listed for each page, and a PDF report keeps a record of the review. Pages are compared by position, so an inserted paragraph that pushes text onto later pages makes those pages differ too. Compare matching sections separately when that happens.

What a signature can prove

Sign PDF places your typed name on a page as a visual signature, which is enough for many informal approvals, timesheets and acknowledgements. It doesn't prove identity or protect the document from later changes. Certificate-based digital signatures do both, using cryptography tied to a verified identity, and they're what many contracts, government forms and regulated processes require. This site doesn't create them. If the signer or recipient needs assurance, ask what method is accepted before relying on a visual signature, and flatten signed documents so the signature can't be casually edited or removed.

A safe order for sensitive documents

Work from content to access. First remove pages that shouldn't be shared. Then redact sensitive areas, remove metadata, and make a clean copy if the file came from outside or will be published. Flatten if comments or form data should be locked. Finally, protect the file with a password or share it as a link that expires, and send the password separately. Check each step: search for redacted words, look at the document properties and open the final file yourself. The processing tools work in a temporary folder with a random name, deleted when the download finishes. Share links are the one exception and keep the file encrypted until the link ends. The file security page describes that handling in full.

Common workflows

Questions about PDF security

Related guides