Choose a strong document password
Avoid short passwords, dictionary words, birthdays and information that can be guessed from the document owner. A longer password or passphrase is usually more resistant to guessing.
Do not reuse a sensitive account password for a PDF. Document passwords should be unique so disclosure of one file does not compromise another service.
Share the password separately
Sending the PDF and its password in the same message weakens the benefit of protection. When practical, send the document and password through different channels.
For example, email the protected PDF and provide the password by phone or another trusted communication method.
Keep an unprotected original securely
Store the source document in a secure location. If the password is forgotten, recovering an encrypted document may be difficult or impossible depending on the protection used.
The protected file should be treated as the distribution copy, while the original remains under the owner’s control.
- Use a long, unique password or passphrase.
- Do not place the password in the filename.
- Share the password separately when possible.
- Verify that the protected file asks for the password before sending it.
Password protection is not access management
A password does not tell you who opened a downloaded copy and cannot revoke a file that another person already possesses.
For workflows requiring audit trails, revocation or identity-based access, a dedicated document-management system may be more appropriate.
Verify encryption and share the password safely
Open the downloaded protected PDF in another viewer and make sure it asks for the expected password. Verify that the recipient will still be able to view the intended document after entering it.
Use a unique passphrase, avoid placing it in the filename and share it separately from the file where practical. Encryption does not redact visible information or remove metadata; review sensitive content before distribution.