Complete PDF Security Is Not Possible
Answering questions that always come up.
PDF Hacking 101
This article is not meant to be a PDF hacking class, nor is meant to give unscrupulous readers any nefarious ideas. But proving the headline with clarity and speed requires a few examples.
Flattened Stamps
I developed a PDF stamp flattener that is a big seller on my company website.
The tool flattens the selected stamp, which means it makes the stamp part of the PDF content so it is no longer a stamp that can moved, deleted, resized, copied, etc. Every once in while I'll get an inquiry from a purchaser of this tool that goes something like this:
"It doesn’t work. I can still copy the stamp with Acrobat Pro."
The Answer
"Among other things, Acrobat Pro is a PDF editor. PDF editors can edit and copy PDF content, including flattened stamps. This does not mean that the stamp flattening tool did not work. The stamp was flattened. If you want to stop the copying of the stamp, then apply encryption (password protection) after you have flattened it. Please understand that there are many ways around this 'solution' and if someone has malicious intent, he will find a workaround."
For Example
A stamp was flattened and encryption was applied to the PDF to prevent changing the document and copying its contents.
Side Note: I have the Windows Snipping Tool pinned to my taskbar because I use it so much.
It takes less than one minute to recreate a stamp, that might contain an image of a wet signature, that was flattened into a PDF, that was subsequently encrypted:
Activate the snipping tool and drag it around the stamp image to copy it.
Select File > Save As and save the image to your desktop.
Activate the stamp menu in Acrobat Pro or Reader and select Create > Custom stamp.
Use the snipped image file to create the stamp. Done.
This technique can be used to create a stamp from any image on your screen.
Editing The Non-Editable
When password protection prevents a PDF from being edited, a copy without password protection can be created, also in less than a minute.
If you attempt to print-to-PDF a document containing the security settings above with an Adobe Printer, it will fail because Adobe respects the security on documents encrypted with its software.
However…
Others do not. This works with the three web browsers with which I'm familiar (and probably many others): Chrome, Brave, and Microsoft Edge.
Right-click the PDF file and select Open with > (any of the web browsers listed above).
When the PDF opens in the web browser, click the printer icon.
Select Save As PDF from the printer dropdown in the dialog. Voila.
You now have an unencrypted copy of the PDF. Keep in mind that any form fields, annotations, and scripts will be gone. It's the same result as converting a file to a PDF, but in this case the source file is also a PDF.
Protecting Intellectual Property in PDF Format
I field a lot of "how-to" questions about creative ideas people come up with to protect their intellectual property (in PDF format) from being shared or resold. Some examples:
A popup that asks for a password when a PDF is opened, then closes the PDF if the password is incorrect.
A popup that asks for the owner's name and other information, then watermarks the PDF with "Licensed to _________".
Both of these methods, and many more not listed, can be set up with JavaScript - but there are lots of problems:
JavaScript can be turned off in the PDF viewer so that scripts don't run.
For the first point you don't need to reinvent the wheel. You can require a password to open a PDF as part of the permission details when you encrypt the document using Acrobat Pro. A bonus is that all three aforementioned web browsers respect this restriction. Nobody will be able to use the open-with-web-browser trick to access the document.
Most non-Adobe PDF viewers don't support many of the scripts supported by Adobe PDF viewers - especially the previously mentioned web browser PDF viewers.
The second example above requires users to save the changes to the PDF, which can't be forced, and assumes that the user did not keep a copy of the unsaved version.
It seems like for every idea to protect a PDF there are at least five ways around it.
Conclusion
Depressing, isn't it? It gets worse. Software that removes encryption from PDFs can be found on the internet with a quick web search. The bottom line is this: There are a lot of things you can do to keep honest people honest, but if you're looking for complete PDF security, it doesn't exist.