The PDF standard’s security handler allows “an owner password and a user password.” The user password opens the file; the owner password governs what happens after. Set either one, or any restriction, and the file is encrypted: “If passwords or access restrictions are specified, the document shall be encrypted, and the permissions and information required to validate the passwords shall be stored in the encryption dictionary.” A file with only a permissions password has an empty user password, so it opens without a prompt and carries its restrictions as flags.

The flags work by convention: “Conforming readers shall respect the intent of the document creator by restricting user access to an encrypted PDF file according to the permissions contained in the file.” Adobe sums up the owner’s side: a password that “Allows you to restrict certain features in the PDF, such as printing, editing, copying content, and adding comments.”

Which permissions can a PDF restrict?

The flags are bits of the encryption dictionary’s P value, listed in Table 22 of ISO 32000-1. “Conforming readers shall ignore all flags other than those at bit positions 3, 4, 5, 6, 9, 10, 11, and 12.” Bits 9 to 12 apply to security handlers of revision 3 or later.

Bit When set, readers may
3 Print, at full quality only if bit 12 is set too
4 Modify the contents, beyond what bits 6, 9 and 11 cover
5 Copy or otherwise extract text and graphics
6 Add or change comments, fill in form fields, and, with bit 4, create form fields
9 Fill in existing form fields, signature fields included, even when bit 6 is clear
10 Extract text and graphics for accessibility
11 Assemble the document: insert, rotate or delete pages, create bookmarks or thumbnails
12 Print a faithful, full-quality copy

How do you read a PDF’s permission flags?

With pdfinfo or qpdf. We restricted a copy of the demo letter with an owner password, an empty user password and AES-256 encryption, allowing printing and accessibility extraction only, and read it back:

$ pdfinfo letter-restricted.pdf | grep Encrypted
Encrypted:       yes (print:yes copy:no change:no addNotes:no algorithm:AES-256)

$ qpdf --show-encryption letter-restricted.pdf
R = 6
P = -1340
User password = 
Supplied password is user password
extract for accessibility: allowed
extract for any purpose: not allowed
print low resolution: allowed
print high resolution: allowed
modify document assembly: not allowed
modify forms: not allowed
modify annotations: not allowed
modify other: not allowed
modify anything: not allowed
stream encryption method: AESv3
string encryption method: AESv3
file encryption method: AESv3

P = -1340 is the flag word as a signed number; qpdf spells out each flag, and the encryption method the flags travel with. On a Mac, Preview’s Inspector and Acrobat’s Document Properties show the same settings; PDF locked for editing walks through both.

What does a permissions password mean for an edit?

PDF Textfix opens every encrypted file view only, whatever its flags allow, and does not remove a restriction; the PDF Textfix manual describes view-only files. Apps that follow the standard lift a restriction only with the owner password, so ask whoever set it for an unrestricted copy. Why can’t I edit text in a PDF? covers the other causes.

Questions about permissions passwords

What is the difference between a user password and an owner password?

The user password opens the file and gives the access its flags allow: it “should allow additional operations to be performed according to the user access permissions specified in the document’s encryption dictionary.” The owner password gives everything: “Opening the document with the correct owner password should allow full (owner) access to the document. This unlimited access includes the ability to change the document’s passwords and access permissions.”

How do you set a PDF owner password on a Mac?

In Preview, choose File > Edit Permissions, enter the owner password, and pick the actions it guards. Apple’s guide: “Select the checkbox next to an action to allow printing or changes without the owner password. Leave the checkbox unselected to require the owner password.”