Encrypting a PDF with AES-256 sounds like the end of the story. It isn't. The encryption key is derived from the password you type, so the file is exactly as hard to open as that password is hard to guess. A strong cipher behind a weak password is like a reinforced door with the key under the mat. This guide covers the two parts people tend to rush: choosing a password that holds up, and getting it to the recipient without undoing the protection.
Why the password is the weak point
Nobody attacks AES-256 head on. Someone who gets hold of a protected PDF, whether from a forwarded email, a lost laptop or a shared folder left open, will instead try passwords. Software can do this tirelessly and offline, working through dictionaries of common words, names, dates, keyboard patterns and their usual variations. A password made of a client's name and a year, or a word with a capital letter and an exclamation mark at the end, sits near the top of those lists.
What slows this down is the number of possible passwords an attacker has to consider. That number grows with every character you add, much faster than it grows when you swap a letter for a symbol.
Length beats complexity
For years, password advice was about complexity: at least one uppercase letter, one digit, one special character. Current guidance has moved on. The US standards body's digital identity guidelines, NIST SP 800-63B, put the emphasis on length and advise against imposing composition rules or forcing periodic changes. France's cybersecurity agency, the ANSSI, likewise reasons in terms of the strength that comes from both length and the size of the character set.
The practical takeaway is simple:
- Go long. A long password made of ordinary characters is generally stronger than a short one full of symbols.
- Go random. Length only helps if the characters or words are unpredictable. "Passwordpasswordpassword" is long and useless.
- Avoid anything tied to the client or the file. Names, company names, dates of birth, file numbers, tax years. If it appears in the email or on the document, assume it will be tried.
- One password per client. Reusing the same password for every client means one leak opens everyone's files.
Two ways to get a strong password
A generated password
The most reliable option is a password produced by a proper random generator. You don't have to remember it, since it will be stored and sent, not memorized. The generator in PDF Protect Plus creates passwords from 16 to 64 characters using your operating system's random source, mixing uppercase, lowercase, digits and symbols. A strength meter shows where the password stands, and when you copy it, the clipboard is cleared automatically after a short delay so it doesn't linger there.
Generated passwords are ideal when the recipient will copy and paste the password from a message. They're less convenient when someone has to read it out over the phone or type it on a small keyboard.
A passphrase
When a human has to type or dictate the password, a passphrase works well: several unrelated words strung together, such as copper-lantern-orbit-meadow-tulip (an illustrative example; don't use it). Five or six words picked at random are long, easy to read aloud and easy to type. The key word is random: a line from a song, a proverb or a sentence about the client is predictable, however long.
The PDF format allows long passwords, and PDF Protect Plus accepts an open password of up to 127 characters, so a passphrase fits comfortably.
Never send the password with the file
This is where most protection fails in practice. The PDF is encrypted, the password is strong, and both are sent in the same email. Anyone who gets that email, through a mistyped address, a compromised mailbox or a forward, gets everything they need.
The rule is to use a different channel for the password:
- A text message or messaging app to the client's phone, after the email has gone out.
- A phone call, which works well with passphrases.
- A password agreed in person at the start of an engagement and reused for that client's documents over a defined period, which many firms find easier on both sides.
- A client portal or separate secure message, if your practice already uses one.
What not to do: put the password in the subject line, in the body of the same email, in a second email sent a minute later to the same address, or in the file name. A second email to the same mailbox is the same channel.
Our guide to sending a PDF password explains the method, with email and text templates you can copy.
Keep track of the passwords you've sent
A strong password you can't find again becomes a problem the day a client calls to say they lost it, or sends a protected file back to you. Writing passwords in a plain spreadsheet on your desktop is risky for the opposite reason.
PDF Protect Plus includes an encrypted local password vault, stored in your operating system's secure storage. It stays on your device; it isn't synchronized to our servers. For larger volumes, batch protection can read a CSV or spreadsheet that pairs each client with their own password, and protect up to 200 PDFs in one run.
Unlocking works the same way in reverse: the app can remove protection from a PDF when you provide the right password. It doesn't try to crack or bypass passwords, so if a password is lost and wasn't stored anywhere, the file stays locked. That's the expected behavior of real encryption, and one more reason to keep a record in a safe place.
A worked example
Consider Dana Reyes, a fictional bookkeeper sending quarterly reports to a dozen small-business clients. At the start of the year, she generates a 20-character password for each client, saves them in the vault, and tells each client theirs by phone. Every quarter, she protects the reports with each client's password and emails them. She never writes the password in an email. When a client asks for it again, she reads it from the vault and texts it.
Nothing here relies on the encryption being perfect or the clients being careful. It relies on three habits: long random passwords, one per client, sent by another channel.
The limits, stated plainly
- A strong password makes guessing impractical; it doesn't make the file safe from someone who already knows the password.
- Anyone you give the password to can open the file and share it onward.
- If the device where you store passwords is compromised, the passwords may be too. Keep your system up to date and locked.
Checklist
- Use a generated password, or a passphrase of several random words.
- Use a different password for each client.
- Never include names, dates or file numbers.
- Send the password by text, phone or in person, never in the same email.
- Store passwords somewhere encrypted, not in a plain file.
To put this into practice, read how to password protect a PDF without uploading it, then download PDF Protect Plus for Windows, macOS or Android and try the generator during the 7-day trial.