Protect module: password and restrictions

The Protect module encrypts your PDF document with a password and configures usage restrictions (printing, copying, editing). Once saved, the PDF will no longer be openable, printable or editable without the appropriate password. You reach this module from the Security category of the Dashboard.

The two types of password

The PDF format distinguishes two separate passwords, which can be used together or separately:

User password

Also called the open password. It is the password requested from anyone trying to open the PDF. Without this password, the document content is inaccessible. It is the password to favour for protecting sensitive documents.

Owner password

Also called the permissions password. It allows the restrictions you have defined (printing, copying, editing) to be lifted. A user who opens the PDF with the user password stays subject to the restrictions; only the owner password allows free action on the document.

This field is optional, but leaving it empty is not without consequence. If you enable restrictions without entering an owner password, HtkPDF generates one at random and never shows it to you: the restrictions then become permanent, and you will not be able to lift them yourself.

This is deliberate. An owner password derived from yours — or identical to it — would be guessed by anyone able to open the document, and the restriction would be worth nothing.

If you want to keep control of the permissions, enter your own owner password, distinct from the user password, and keep it safe.

Entering the passwords

The Password section offers three secure fields (the characters are not shown on screen):

• New password (User): mandatory;
• Confirm: confirmation of the user password. The two fields must match exactly;
• Owner password (Optional): for fine-grained control of the restrictions.

The Apply button is disabled as long as the main password is empty. On confirmation, if the two user fields do not match, the message "The passwords do not match" is shown.

A password is written without accents: unaccented letters, digits and keyboard symbols. macOS cannot encrypt a PDF with "é", "ñ" or "€" — worse, it would save the file with no protection at all while reporting success. HtkPDF therefore rejects these characters on confirmation, with the message "Unaccented letters, digits and keyboard symbols only". The same rule applies to batch processing and the "Protect PDF" shortcut.

Configuring the restrictions

The Permissions section lets you allow or disallow three common actions:

Allow printing

If disabled, the user (with the user password) will not be able to print the document. Some applications will show an error message, others will grey out the Print menu.

Allow copying

If disabled, the user will not be able to select and copy text or images from the PDF. Use it to limit unauthorized distribution of the content.

Allow editing

If disabled, the user will not be able to add annotations or fill in forms. The PDF stays readable but no intervention is possible.

Note: these restrictions only apply to users who do not have the owner password. A quality PDF reader respects these flags, but third-party tools can bypass them — password protection remains the most robust measure.

Applying to the document

Unlike the other editing modules, protection is not applied immediately to the working PDF visible on screen. It is stored as a security option and applied only when the document is saved:

1. Configure the passwords and the permissions;
2. Click Apply to confirm the configuration and return to the Dashboard;
3. Click Save (⌘S) on the Dashboard to produce the encrypted PDF.

It is at this final save step that HtkPDF encrypts the document and writes the permission flags. A checkpoint is also added to the History when the configuration is made, indicating that a protection is awaiting application.

The protection then sticks: the document card switches to Protection: Yes, and every subsequent save — after a rotation, a watermark, any tool — reapplies the same passwords and permissions. To lift it, use the Unprotect module.

Best practices

• Record the password in a password manager (Keychain Access, 1Password, Bitwarden) before saving the document. Without the password, you will no longer be able to reopen the file — there is no recovery mechanism.
• Keep an unprotected copy in a secure location if you plan to rework the document later.
• Use two distinct passwords for documents distributed publicly: the user password (often shared) allows opening, the owner password (private) allows updating.
• Strong password: favour long passwords (12+ characters) combining upper case, lower case, digits and special characters. Simple passwords are vulnerable to dictionary attacks.
• Combine with flattening for highly sensitive documents: a flattened + protected PDF is markedly harder to manipulate than a merely protected one.

Removing an existing protection

To remove the protection from a protected document whose password you know, use the Unlock module in the same Security category. It will ask for the owner password (or the user password, as the case may be) and produce a decrypted copy.

Screenshots

1 screenshot — click to enlarge

Close