Check a PDF's Encryption and Permissions
Checking a PDF's encryption means reading its encryption dictionary: which algorithm and key length protect the file, whether a user password is required to open it, and which permission flags (printing, copying, editing, form filling) the author set. This tool runs qpdf's --show-encryption inspection in your browser and translates the raw report into plain English. Nothing is uploaded and no password is needed for owner-password-only files.
How it works
An encrypted PDF is not encrypted end to end. The file's skeleton — the trailer, the cross-reference data, and an encryption dictionary — stays readable, while strings and streams (page content, images, embedded fonts) are encrypted with a file key. The encryption dictionary records everything an inspector needs: the security handler revision R, the key length, the cipher (RC4 for revisions 2–4, AES-128 for revision 4, AES-256 for revision 6), and a 32-bit permissions integer P whose individual bits grant or deny printing, modification, content copying, annotation, form filling, accessibility extraction, document assembly, and high-resolution printing.
The crucial distinction the report surfaces is user password versus owner password. The user password is the real lock: it is fed through a key-derivation function to produce the file key, and without it the content cannot be decrypted. The owner password only controls the restriction settings. A file protected with an owner password alone is encrypted against an empty user password — that is why it opens without a prompt in every viewer. Such files are only as "protected" as viewers choose to be polite: the permission flags are honored by compliant software, not cryptographically enforced, since the viewer necessarily holds the decryption key already. The PDF specification (ISO 32000) is explicit that enforcement of P is the viewer's responsibility.
To read all of this reliably, including malformed or unusual files, this page runs qpdf — the open-source PDF transformation tool — compiled to WebAssembly (about 1.2 MB, fetched once on first use, then cached). Your file goes into an in-memory filesystem, qpdf --show-encryption produces the raw report, and the page displays that verbatim alongside a plain-English interpretation: what the R value implies about the cipher's age and strength, what each permission bit means in practice, and whether the protection would actually stop anyone. The file never leaves your machine, which matters precisely when you are inspecting a document sensitive enough to be encrypted.
Worked example: a contract that will not print
A 14-page, 2.1 MB signed contract opened normally in every viewer but the print button was grayed out. Dropping it on this tool produced the qpdf report in under a second: R = 4, P = -3904, 128-bit AES, User password = (empty). The interpretation panel decoded it: no user password, so anyone can open the file; owner password set; printing denied, high-resolution printing denied, content copying denied, but form filling and accessibility extraction allowed.
That single line — user password empty — answered the practical question. The restrictions were viewer-honored flags, not cryptography: the document key was already derivable by any reader, which is why the file opened without a prompt. The recipient asked the sender for an unrestricted copy, the clean route. The report also flagged that a sister document from 2013 in the same folder used R = 2, 40-bit RC4 — encryption weak enough to brute-force in hours, worth re-protecting with AES-256 before archiving.
Frequently asked questions
How can I tell if a PDF is password protected?
Load the file into an inspector like this one: if the encryption dictionary requires a user password, the report says the document cannot be opened without it, and viewers will show a password prompt. If only an owner password is set, the file opens normally but carries restriction flags. An unencrypted file simply has no encryption dictionary at all.
What is the difference between a user password and an owner password on a PDF?
The user password is required to decrypt and open the document at all. The owner password only gates the restriction settings: a file with just an owner password is encrypted with an effectively empty user password, so any viewer can open and decrypt it, and the permission flags are the only thing the owner password protects. That is why owner-only protection is far weaker than open protection.
What do the R and P values in a PDF encryption report mean?
R is the security handler revision: R2 and R3 mean RC4 at 40 or 128 bits, R4 adds AES-128, and R6 is the current AES-256 scheme from PDF 2.0. P is a 32-bit integer whose individual bits grant printing, modification, copying, annotation, form filling, accessibility extraction, assembly, and high-resolution printing. A P value of -4 means every permission bit is set.
Are PDF permission restrictions like no printing or no copying actually secure?
No. Permission flags are an honor system: the file is decrypted with a key the viewer already has, and the flags merely ask compliant viewers to disable menu items. Any tool that ignores the flags can print or copy freely, which is why the PDF specification itself leaves enforcement to the conscience of the viewer. Only a user password provides cryptographic protection.
Does this tool need my password to inspect the PDF?
Not for files with only an owner password, because the encryption metadata and permission flags sit in the unencrypted trailer and can be read directly. If the file requires a user password to open, the report will still identify the algorithm and revision, but decrypting the contents would need the password. Either way the analysis runs entirely on your device.
Is 40-bit or 128-bit RC4 PDF encryption still safe?
40-bit RC4 is thoroughly broken: the key space is small enough to brute-force in hours on ordinary hardware, regardless of how strong the password is. 128-bit RC4 resists brute force but uses a deprecated cipher with known statistical weaknesses. For anything sensitive, re-encrypt with AES-256, which is what the protect tool on this site applies.