How to Protect Your PDFs: Privacy and Security, Explained Properly

"Protecting a PDF" sounds like it just means adding a password, but in practice there are at least three separate things at play: who can open the file, what information leaks out even if nobody opens it, and where your file actually goes while it's being processed. All three matter, and they're easy to mix up.

Passwords: what they actually protect, and what they don't

A PDF can carry two different kinds of password, and they do very different jobs:

• An open password: without it, the file can't even be opened. This is the real protection if you want only people with the key to see the content.
• A permissions password: the file opens freely, but restricts actions like printing, copying text, or editing. It's useful for controlling how a document gets used, but it doesn't hide the content — anyone who opens it can read it, and these restrictions can even be bypassed with third-party tools. Don't confuse it with actual privacy protection.

If what you need is to keep unauthorized people from seeing the content at all, the open password is the one that matters. If you just want to stop someone from accidentally editing an official document, the permissions password is enough.

What slips through the cracks: metadata

A PDF stores more information than what shows up on screen. Its file properties usually record the author, the program it was created with, the creation and modification dates, and sometimes even the username of the computer that generated it. If you convert a scan or a photo into a PDF, it can also carry over metadata from the original image — device make, and in some cases GPS location, if the photo was taken on a phone and never cleaned up beforehand.

Before sharing a PDF with sensitive content — a résumé, a legal document, anything you'd rather not tie directly to your full name or location — it's worth checking the file's properties (in most PDF readers: File > Document Properties) and clearing out whatever you don't need left there.

Why where your file gets processed matters as much as the password

Here's the part most people overlook: a lot of "free" online tools for editing, compressing, or converting PDFs work by uploading your file to a server, processing it there, and handing you back the result. That means that during that process, your document — with whatever it contains — passes through a server you don't control, run by a company you probably know nothing about, under terms of service almost nobody reads.

It's not necessarily malicious, but it's a layer of exposure that's completely unnecessary if the file can be processed without ever leaving your device. Tools that do the work directly in your browser — like Unido's — never upload the file anywhere: all the processing (merging, splitting, compressing, converting) happens with JavaScript, inside your own browser, and the file never leaves your computer or phone.

What to check before using any random online tool

You don't need to be a security expert to run a couple of quick checks before uploading a sensitive document to some website:

• Does it explicitly say whether it uploads your file to a server or processes it in the browser? If it doesn't say, assume it uploads it.
• Does it have a privacy policy? And if it does, does it explain what happens to the files you process, or does it only talk about cookies and ads?
• Does it ask you to sign up with unnecessary personal details for a simple task like compressing a file?
• Does the site use HTTPS? That's the bare minimum — if it doesn't even encrypt the connection, don't trust it with anything sensitive.

Quick good habits

• Add an open password to any PDF with personal, financial, or legal data before emailing it.
• Check and clean the metadata on documents you're about to share publicly or with strangers.
• Favor tools that process files in your browser instead of uploading them to a server, especially for sensitive documents.
• If you need to compress or merge documents with private information, do it with a tool that doesn't require uploading the file anywhere.

The bottom line

Protecting a PDF isn't just about adding a password: it's about thinking through who can open it, what information it carries without showing it, and where it travels while it's being processed. All three are just as easy to handle once you know they exist.