Explained
Is Your PDF Password Actually Secure? AES-256 Explained
Not every "password protected" PDF means the same thing
5 August 2026 · 4 min read
Quick answer
A genuinely password-protected PDF uses AES-256 encryption — the file's actual contents are unreadable without the password, in any viewer. If a different PDF reader can open the file without asking for a password, it was never really protected.
Search "password protect a PDF" and every result claims to do it. Whether they mean the same thing by "protect" varies a lot more than people assume.
What AES-256 actually means
AES-256 is an encryption standard — the same one used for banking and government data. When it's applied properly, the document's contents are mathematically scrambled and genuinely unreadable without the correct password. There's no way to strip it by editing metadata or opening the file in a different tool.
The weaker version: a lock on the viewer, not the file
Some tools implement "password protection" as a viewer-side check — the app itself asks for a password before displaying the content, but the underlying file isn't actually encrypted. Open the same file in a different PDF reader, and it might open freely, no password asked. That's a lock on the door, not on the file.
How to test any tool's claim yourself
Protect a test file with the tool in question, then try opening it in a completely different PDF reader — ideally one from a different company entirely. If it opens without a password anywhere, real encryption wasn't applied.
How we verified our own
iGuardPDF's Password Protect PDF applies real AES-256 encryption via a dedicated encryption library, checked during development against poppler — an independent, open-source PDF implementation — rather than just trusting our own code to check its own work.
Frequently asked questions
What's the difference between AES-128 and AES-256?
Both are real encryption standards; AES-256 uses a longer key, generally considered the stronger of the two. Either is a genuine step above a viewer-side-only lock.
Can a PDF password be cracked?
Given enough time and computing power, theoretically most encryption can eventually be attacked — but a strong, unique password with real AES-256 encryption is far beyond what's practical to brute-force for casual access.
Should I still add other protection on top of a password?
A password stops someone without it from opening the file. It doesn't stop someone WITH the password from forwarding it further — that's what fingerprinting and revocable share links are for, a separate layer covering a separate problem.
Related tools
Password protection is often paired with:
"Password protected" should mean genuinely unreadable without the password — not just that one particular app asked for one. When it matters, test it yourself.
Safe in our hands
iGuardPDF takes file handling seriously. A few things worth knowing, whichever tool you're using:
- Every upload and download runs over TLS (HTTPS) — your file never crosses the network unencrypted.
- Files are processed to run the tool you asked for, then deleted. We don't archive uploads or keep a copy afterward.
- Free tools need no account, so there's no identity to build a tracking profile against in the first place.
- Nothing you upload is ever used to train an AI model, ours or anyone else's.
Full breakdown on our Security page.