Understanding PDF Permissions and Restrictions

What are PDF permissions?

PDF permissions are a set of controls embedded in a PDF file that determine what actions users can perform with the document. These controls are part of the PDF specification - the official standard that defines how PDF files are structured - and they are enforced through a combination of encryption and password protection.

When someone creates a PDF, they can choose to restrict various actions: printing, copying text, editing content, adding annotations, filling in form fields, and more. These restrictions are written into the PDF file itself and enforced by any PDF viewer that follows the specification. When you open a restricted PDF and find you cannot copy text or cannot print, that is the permission system at work.

PDF permissions are controlled by two different types of passwords, each serving a different purpose. Understanding the difference between these two passwords is the key to understanding how the entire permission system works. Most people do not realise that the "password" they use to open a PDF and the "password" that controls what they can do with it are two entirely separate things.

The two types of PDF passwords

The PDF specification defines two distinct passwords that serve fundamentally different roles. Confusing them is one of the most common misunderstandings about PDF security.

User password (document open password)

The user password controls access to the document itself. If a PDF has a user password set, you must enter the correct password before you can view any of the document's contents. Without it, the PDF viewer will display a password prompt and refuse to show the document.

Think of the user password as a lock on the front door. Without the key, you cannot get in. The document's contents are encrypted, and the password is needed to decrypt them. If you do not have the user password, you cannot read the document, cannot copy from it, cannot print it, and cannot do anything else with it. The encryption is real and strong - modern PDFs use AES-256 encryption, the same standard used by governments and financial institutions.

Owner password (permissions password)

The owner password controls the permissions - what actions are allowed once you can view the document. A PDF can have an owner password without having a user password, which means anyone can open and view the document, but certain actions (like printing, copying, or editing) are restricted.

Think of the owner password as an administrative override. The document owner sets restrictions using this password, and anyone who knows the owner password can change or remove those restrictions. Regular users who open the document without the owner password can view it but must abide by whatever restrictions were set.

How they work together

The most common configuration is owner password only. This is what you encounter when you can open and read a PDF without any password prompt but find that printing or copying is disabled. The document creator set an owner password to enforce permissions but did not set a user password, so the document opens freely for viewing.

What permissions can be controlled

The PDF specification defines a specific set of permissions that can be individually enabled or disabled. Here is a complete breakdown of every permission flag and what it controls:

Printing

The document creator can allow or deny printing entirely, or allow only low-resolution printing. When low-resolution printing is enabled, the document can be printed but at a reduced quality (typically 150 DPI instead of the full resolution). This is sometimes used for documents like draft manuscripts or review copies where the creator wants to allow reference prints but not high-quality reproduction.

Content copying

This permission controls whether users can select and copy text, images, or other content from the PDF. When copying is disabled, you can view the content on screen but cannot select it, copy it to the clipboard, or extract it for use in another document. This is commonly applied to copyrighted materials, published books, and proprietary reports.

Editing and modifying

This permission determines whether the document's content can be changed. When editing is restricted, users cannot modify text, rearrange pages, delete pages, or alter the document structure. This is separate from annotation permissions - a document might allow comments and highlights but prohibit changes to the underlying content.

Annotations and comments

This controls whether users can add comments, highlights, sticky notes, and other annotations to the document. Some document creators restrict editing but allow annotations, enabling a review workflow where readers can mark up the document without changing the original content.

Form filling

This permission specifically governs whether users can fill in interactive form fields. A PDF form might have editing restricted but form filling allowed, so users can enter data into designated fields without being able to modify the form structure itself. This is the standard configuration for government forms, applications, and surveys.

Content accessibility

This permission controls whether screen readers and other accessibility tools can extract text from the document. In modern versions of the PDF specification, disabling accessibility extraction is discouraged and many PDF viewers ignore this restriction to comply with accessibility laws and standards. Most PDF tools created today leave this permission enabled by default.

Document assembly

This controls whether users can insert, delete, rotate, or reorder pages. When document assembly is restricted, the page structure is locked - you cannot add pages from another PDF, remove pages, or change the page order. This is useful for documents where page integrity matters, such as legal filings or certified reports.

How PDF permissions actually work technically

Understanding the technical mechanism behind PDF permissions helps explain both their strengths and their limitations.

The encryption layer

PDF permissions are enforced through encryption. When a document creator sets permissions and an owner password, the PDF is encrypted using a standard algorithm (RC4 in older PDFs, AES-128 or AES-256 in modern ones). The permissions flags are embedded in the encryption dictionary - a data structure within the PDF file that stores the encryption parameters, the permission settings, and hashed versions of the passwords.

How viewers enforce permissions

When you open a permission-restricted PDF, the PDF viewer reads the encryption dictionary to determine which permissions are set. If the document has a user password, the viewer prompts you for it before decrypting and displaying the content. If only an owner password is set, the viewer can decrypt and display the content without a password, but it reads the permission flags and disables the restricted features in its interface - greying out the print option, disabling text selection, blocking the edit functions.

The honour system factor

Here is the important nuance that many people do not understand: when a PDF has only an owner password (no user password), the permission restrictions are enforced by the PDF viewer software, not by unbreakable encryption. The document's content is technically accessible - it has to be, because the viewer needs to display it without a password. The viewer chooses to respect the permission flags and disable restricted features.

Well-behaved PDF viewers (Preview, PDF Expert, Paradise PDF, and all major browsers) honour these permission flags faithfully. They disable printing when printing is restricted, prevent text selection when copying is restricted, and block editing when editing is restricted. This is part of following the PDF specification correctly.

However, because the content itself is accessible (the viewer can display it), owner-password-only permissions are not the same as true access control. They are a strong signal of the document creator's intent and a genuine technical restriction in all major PDF tools, but they are not equivalent to the encryption barrier created by a user password. If you need absolute security - preventing anyone without a password from even viewing the content - you need a user password, not just an owner password with restrictions.

How to view the permissions on a PDF

Before you can work with a restricted PDF, it helps to know exactly what restrictions are in place. Here is how to check permissions using different tools:

Using macOS Preview

Open the PDF in Preview. If the document has restrictions, you will notice them through the interface - for example, text selection might not work, or the Print option might be greyed out. However, Preview does not provide a detailed permissions panel. To see the full list of permissions, you will need a more capable PDF tool.

Using a dedicated PDF app

Most dedicated PDF applications display document permissions in their file properties or document info panel. In apps like PDF Expert, Sejda, and Paradise PDF, you can view the full list of permissions - which ones are allowed and which are restricted. This gives you a clear picture of exactly what you can and cannot do with the document.

Using the command line

On macOS, you can use the built-in mdls command to view some PDF metadata, though it does not show permission details. For detailed permission information from the command line, tools like QPDF or pdftk can read and display the full permission flags. For example, qpdf with the show-encryption option will display the encryption method, the permission flags, and whether user and owner passwords are set.

How to set permissions on your own PDFs

If you are creating PDFs and want to control what recipients can do with them, here is how to set permissions effectively:

Deciding which restrictions to apply

Before setting permissions, think about what you actually need to restrict. Common scenarios include:

• Protecting copyrighted content: Restrict copying and editing, allow printing and viewing
• Review copies: Allow annotations and comments, restrict editing and high-quality printing
• Fillable forms: Allow form filling, restrict everything else
• Confidential viewing only: Set a user password and restrict all actions except viewing
• Reference documents: Allow viewing and printing, restrict copying and editing

Setting permissions in PDF tools

Most PDF creation and editing tools let you set permissions when saving or exporting a PDF. The typical workflow is:

1. Open or create your PDF in your chosen tool.
2. Navigate to the security or permissions settings. This is usually found in File, Properties, Security, or a similar menu path. In some tools, it is part of the Export or Save As dialog.
3. Set the owner password. This is the password that controls who can change the permissions. Choose a strong, unique password and store it securely - if you lose the owner password, you cannot change the restrictions later.
4. Configure individual permissions. Enable or disable each permission category: printing, copying, editing, annotations, form filling, and document assembly.
5. Optionally set a user password. If you want to require a password to open the document (not just to change permissions), set a user password as well. Make sure this is a different password from the owner password.
6. Save the PDF. The restrictions are now embedded in the file and will be enforced by any PDF viewer that follows the specification.

Best practices for setting permissions

• Always set a strong owner password - without one, anyone with a PDF editor can remove your restrictions
• Keep the owner password in a secure location (password manager, secure notes)
• Do not over-restrict - if someone legitimately needs to print your document, blocking printing creates friction without adding meaningful security
• Remember that restrictions without a user password are a usage guideline, not an impenetrable barrier - set expectations accordingly
• If true confidentiality is required, always set a user password in addition to the owner password

How to change or remove permissions

If you have the owner password for a restricted PDF, you can change or remove the permissions. If you do not have the owner password, you cannot modify the permissions through legitimate means - this is by design.

When you have the owner password

1. Open the PDF in a PDF tool that supports permission management.
2. Navigate to the security settings (same location where permissions are set).
3. Enter the owner password when prompted.
4. Modify the permissions as needed - enable or disable individual restriction categories, or remove all restrictions entirely.
5. Save the PDF. The updated permissions take effect immediately.

When you created the PDF but forgot the owner password

This is a frustrating but common situation. If you created the PDF and set an owner password but did not record it, you are in the same position as any other user - you cannot change the permissions without the password. This is why storing your owner passwords securely is so important. For your own future PDFs, use a password manager to track the owner passwords you set.

When you received a restricted PDF from someone else

If someone sent you a PDF with restrictions that prevent you from doing what you need (for example, you cannot copy text from a reference document for a report you are writing, or you cannot print a form you need to submit), the correct approach is to contact the document creator and request an unrestricted version or ask them to share the owner password. Most restrictions are set intentionally, and the document creator can provide access when there is a legitimate need.

Common permission scenarios explained

"I can read this PDF but I cannot copy any text"

The document has an owner password with copy restrictions enabled. There is no user password (which is why you can open and read it), but the content copying permission is disabled. Your PDF viewer is respecting this restriction and disabling text selection. Contact the document creator if you need to copy content for legitimate purposes.

"The print option is greyed out"

The document creator disabled printing permissions. As with copy restrictions, this is enforced by the PDF viewer based on the permission flags in the file. If you need a printed copy, contact the creator for an unrestricted version or a version with printing enabled.

"I am asked for a password every time I open this file"

The document has a user password set. You need the correct password to access the document's contents at all. This is genuine access control - the content is encrypted and cannot be viewed without the password. If you open the file frequently, some PDF tools (and macOS Keychain) can remember the password for you so you do not have to enter it each time.

"I can fill out the form but cannot change anything else"

The document has form filling enabled but editing restricted. This is the standard configuration for distributable forms - the form creator wants you to fill in the fields but does not want the form structure or instructions to be modified. This is working as intended.

"I need to annotate this PDF but comments are disabled"

Annotation permissions are disabled. The document creator restricted the ability to add comments, highlights, and other markups. This is less common than copy or print restrictions but occasionally appears in final versions of official documents. Contact the creator if you need to add annotations for a review or feedback process.

Encryption standards in PDF security

The strength of PDF permission enforcement depends partly on the encryption standard used. Here is how the standards have evolved:

When setting permissions on your own PDFs, use AES-256 encryption if your tools support it. This ensures the strongest available protection for both user password encryption and permission enforcement. Most modern PDF tools default to AES-128 or AES-256 when creating encrypted PDFs.

Practical tips for working with restricted PDFs

• Always check permissions first when a PDF does not behave as expected. If you cannot copy, print, or edit, the cause is almost always a permission restriction, not a bug in your PDF viewer.
• Contact the document creator if you need to perform a restricted action for legitimate purposes. Most permission restrictions are set as defaults and the creator is often willing to provide an unrestricted copy when asked.
• Use a password manager for owner passwords you set on your own PDFs. Losing the owner password means losing the ability to change permissions on your own documents.
• Do not over-restrict your own PDFs. Blocking printing on a document that people need to reference on paper, or blocking copying on a document that people need to quote, creates frustration without meaningful security benefits. Restrict only what genuinely needs restricting.
• Use a user password when confidentiality matters. Owner-password-only restrictions control usage but do not prevent access. If the document should be viewable only by authorised people, set a user password.
• Keep copies of unrestricted originals. When you create a restricted PDF for distribution, save the unrestricted original separately. This gives you the flexibility to create new versions with different permissions later without needing to remove restrictions from the distributed copy.

Related reading

• password protect a PDF
• remove a password from a PDF
• Protect PDF tool