How to add security to a PDF & prevent removal

How to add security to PDF files and which solution is best

Here we cover the different ways you can add security to PDF documents to prevent piracy, leakage and misuse, and which solution is best.

There’s a reason why billions of documents are shared in PDF format each year.  No matter what application you export from or device you are using, a PDF will look the same.  It maintains the layout of the original file type in much the same way a printed copy would while allowing for interactive elements.  This makes it the perfect choice for all types of enterprise documents, as well as ebooks, magazines, manuals, and flyers.  The only thing holding it back is its security.

With Adobe’s focus understandably on maintaining and improving PDF creation and editing functionality, it has not paid much attention to protection.  By default, any user can edit, share, copy and paste from, or print anybody else’s PDF file.  This might be fine if you’re sharing with family or friends, but it becomes problematic if you’re selling a PDF online or communicating sensitive information.  To do so without leaks or rampant piracy, you need to add additional security to a PDF.

   10 top security controls you can add to a PDF

All apps that add security to a PDF provide a different level of security and features.  Here are the most important ones you should be looking for.

1. Locking of PDF docs to a device
   This prevents users from sharing PDF files with others, which cannot be achieved if using Google Docs to share as PDF or other online solutions.
2. Preventing editing
   It is necessary to prevent editing to stop any other controls from being bypassed and ensure that documents cannot be modified to include false information or dangerous links.
3. Preventing copying & pasting
   Without copy-and-paste prevention, users can easily share information with others or use it to create a new document that does not have any restrictions.
4. Preventing printing
   Though printing is desirable in some circumstances, physical copies can not be controlled in the same way as digital ones.  Users may print additional copies for sharing or scan printed copies back in as an image.
5. Preventing screenshots
   Screenshots are one of the easiest ways to share information with others, but they can be very challenging to stop.  A solution that can prevent third-party screen grabbing apps is typically a step ahead of the rest.
6. Non-removable & dynamic watermarks
   If watermarks can be removed then they are useless.  The ability to add irremovable watermarks to your PDFs that automatically add dynamic information (such as the reader’s name) at view or print times is invaluable.  They dissuade users from sharing printed copies or from taking pictures of their screens with a secondary device and sharing those.
7. Expiry
   Allows you to make PDFs available for only as long as is necessary.  This ensures that out-of-date information does not remain in circulation and that subscription services can be enforced.
8. Document revocation
   This is a key feature to prevent PDF access in the event that an employee leaves the company, a customer issues a chargeback, or other misuse is suspected.
9. Location locking
   Allows you to stop users from accessing PDFs outside controlled locations such as the office, or in countries where you do not have publication rights.
10. Document tracking
    View and print logging can be a valuable tool for creating an audit trail and to determine how much your documents are actually being used.  If users can bypass security controls or share login credentials however then tracking is useless.

   The 3 worst methods used to add security to a PDF

There are some PDF security solutions that aren’t even worth considering:

1. Passwords
   Authorized users can share login or open passwords with unauthorized ones or they can be brute-forced if they are not very strong.  Additionally, passwords must be securely distributed and managed — a difficult and expensive feat.  Permission passwords on PDFs (editing, printing, and copy-paste) are trivial to remove with free online tools.
2. JavaScript
   All document protection in the browser uses JavaScript and it is ineffective.  You can use a browser’s developer mode or specially designed browser plugins to bypass PDF controls in data rooms, Google Docs, Word Online, etc.  Some companies also use JavaScript to protect Adobe Acrobat documents and add expiry controls, but this can introduce severe security vulnerabilities and is similarly ineffective.
3. Plugins
   Adobe PDF plugins cannot provide consistent security.  They can be intentionally or unintentionally broken by other plugins and often stop working after Acrobat is updated.  DRM security plugins can also put users systems at risk.

How to add security to a PDF file without purchasing Adobe

The natural inclination is to look for a free solution to add security to PDF files – and there are many out there.  There are dozens of free online PDF password protection solutions and dozens more offline ones.  How to add security to a PDF with these solutions is a three-step process:

1. Upload your unprotected PDF file to a website (or download an application and use that).
2. Press the “Protect” button and enter a password.
3. Save the protected PDF for distribution.

When a solution is simple and free, it tends to take off.  But that does not always mean that it’s effective.  The type of tools used to add security to PDF files use the same PDF password protection found in Adobe Acrobat.  Though the cryptography used to password protect the PDF is strong, the protection method isn’t:

• The open password can be shared with others or simply removed.
• The permissions password (used to restrict editing, copying, printing) can be instantly removed using free online tools – see PDF password security.
• Additionally, uploading a sensitive PDF to somebody else’s server is rarely a good idea.

For these reasons, while it’s possible to add security to a PDF using free tools, it’s not going to make much practical difference.  There are just too many widely publicized ways to bypass the controls and it is simple for authorized users to grant access to unauthorized ones.

   Adding security to a PDF using certificates

Password encryption isn’t the only way to add security to PDF files and prevent unauthorized access.  Adobe Acrobat also allows users to utilize certificate encryption using Public Key Infrastructure (PKI).  Certificates are used to identify who created an encrypted file without allowing unauthorized users the ability to use that information to break into the PDF.  In other words, they are a mechanism for securely exchanging keys, and (provided the encryption algorithm is strong) they work quite well.

Certificates are more secure than passwords because you do not have to figure out a secure way to share them, users are less likely to share their private keys, and you can add a digital signature to secure PDF files so that recipients know who the document originated from.

However, the important thing to consider is that certificates only stop unauthorized parties from opening your documents.  Once the PDF has been opened and decrypted, they can do whatever they like with it, including editing, copying, printing, or saving to a decrypted file and sending that to others.  Digital signatures added to a secure PDF are not as secure as you may think either – they can be bypassed or additional info added to the PDF which is not part of the original signed version.  See PDF digital signature security for more info.

Certificates can also be inconvenient from both a user and management perspective.  Users must have key pairs generated in advance, and ideally, certificates should be stored in a central directory server for easy access.  Then you need systems in place to manage the revocation and generation of certificates, as well as support infrastructure, as it can seem complex from a user perspective.

Certificates ultimately still need to be paired with additional controls to prevent copying, saving, editing, and printing, and ideally also need to be simplified.

   How to add security to PDF files with DRM

At this point, it’s probably clear that if you want add security to PDF files that provides strong protection, you’re going to have to pay for it.  However, not all paid solutions are equal.  Options such as Adobe Digital Editions, secure data rooms, and Azure information protection all fail to prevent screenshots, printing, and copy and pasting – and therefore sharing in general.  The best way for adding security to PDFs is therefore using DRM or Digital Rights Management.

  How Locklizard PDF DRM works

Locklizard uses a combination of strong AES 256-bit encryption, transparent licensing, and a secure viewer application to prevent the sharing and misuse of PDF files.

Here’s the process you go through to add security to PDF documents using Locklizard:

1. You open the PDF in the Safeguard Writer application and choose the DRM controls you want to enforce (printing, expiry, watermarks, screenshotting, etc.).
2. Once you press publish, Safeguard will encrypt your PDF file so that unauthorized users will not be able to open it and nobody will be able to edit or copy and paste from it.
3. In your admin portal, you add users, and a license file is automatically sent to their email.
4. Provided a user has activated a valid license file, decryption keys will be securely transmitted to an encrypted keystore when they open an encrypted PDF. These decryption keys cannot be shared or copied to other devices.
5. The document will only open in the Locklizard Safeguard Viewer application, which prevents copying, screenshots, printing, and editing. It can also display dynamic watermarks which identify the person using the document.

When you recall or revoke authorization to a PDF, even those who have already downloaded it will not be able to open it.  All they will have left is an encrypted file that they cannot open.

  How can I add security to a PDF with Locklizard Safeguard?

The Safeguard Writer application allows you to add security to your PDF files through a simple GUI.  Here’s how you add security to a PDF:

1. Right-click on the PDF and choose “Make secure PDF”.
   
2. Select the copy protection controls you want to apply.  By default, editing, copying, and printing are disabled.  We recommend adding a watermark to your digital and printed documents.  This deters users from taking a picture with their phone or scanning a copy and running it through an OCR recognition tool.
   
3. Press the Publish button to protect the PDF.  Your protected PDF will output it as a .pdc file in the same folder as the original PDF.
   
4. Add a user account and send them their license via the Safeguard admin portal.  See how to add a new user and grant them document access.
   

From this point, though users can share the encrypted file, only users that you give access to in the Safeguard Admin portal will be able to open it.  Devices that have not activated a valid Locklizard license file will not be able to access the document. License files are single-use by default.

  How to add PDF security programmatically

If you have many PDFs that you need to encrypt at once, doing so via a GUI will be time-consuming.  Instead, you can use Locklizard’s command-line PDF tool to add security programmatically or in batch.  All controls that are present in the GUI can be added to documents automatically via the command line.

Here’s how to add security to multiple PDF files at once:

1. Find the installation path to your PDCWriter application by right-clicking its shortcut and choosing “Open file location”.
   
2. Add the PDF files you want to protect to a folder and create an output folder for the protected files.
   
3. Create a new notepad document and paste your command and protection options into it.  You can find examples and options in our command line guide.
   
   Here is the command used in the screenshot:

   "C:\Program Files (x86)\PDF Writer Enterprise\PDCWriter.exe" Protect "C:\Users\%UserName%\Desktop\PDFs\Unprotected PDFs\*.pdf" /Overwrite /WMVIEW /WMTEXT "CONFIDENTIAL. DO NOT DISTRIBUTE" /WMFONT "TAHOMA, 16, B" /WmtPos "10" /Check "Always" /IDINFILENAME /COPYCLIPBOARD /Output "C:\Users\%UserName%\Desktop\PDFs\Protected PDFs"

4. Press “File > Save as” and save enter “protect.bat” with the file type set to “All files”.
   
5. Run the .bat file to protect all PDFs in your “Unprotected PDFs” folder.  Unless you chose not to display it, a window will show you which PDFs were successfully protected once the process is complete.
   

You can group documents into a publication and use /access “publication name” to easily assign access to multiple document groups.  Alternatively, if you sell ebooks online or other PDF products, then you can make use of our e-commerce API to add customers to your admin system automatically when they purchase.

   The best way to add security to PDF files

Locklizard Safeguard allows you to add security to your PDF files securely, quickly, easily, and at a reasonable cost. Unlike secure data rooms or Adobe Acrobat security, our PDF DRM solution locks documents to devices so they cannot be shared, and prevents screenshots, editing, printing, and copying.  You can revoke users and documents at any point or after certain criteria are met, and accurately track who is opening your documents, where, and when.  We don’t use passwords or certificates for security or require a persistent internet connection to work.  You maintain control over your documents regardless of where they are stored and who is using them.

Take a 15-day free trial of our PDF DRM software to see how Locklizard Safeguard can help you add security to your PDF documents to prevent piracy and misuse.

   FAQs

Can I add security to a PDF using certificates with Locklizard?

No, because Locklizard does not use certificate security.  Although we use PKI, all key operations are transparent.  You should remove your certificate security from your PDF before you protect it with Locklizard.

How to add security to a PDF on Linux using Locklizard?

It is not possible to natively add security to a PDF on Linux using Locklizard because the Writer application is Windows only.  You may be able to use Wine, but this is not a supported use case nor guaranteed by us.

Our installed Viewer app works on Windows, Mac OS, iOS, and Android, but you can view protected PDFs on Linux in the browser using our secure web viewer.

How can you add comments to a secure PDF document?

You add comments to a secure Locklizard PDF document by selecting the drop-down arrow under the highlight, underline, or strikethrough tools in Safeguard Windows Viewer and typing your comment.  When you use the tool to format your chosen text, hovering over that text will display the comment.  When you save the document, a separate PDC annotations file will be created so that the original document does not need to be modified.  Opening the document will automatically load its comments, provided both files are in the same folder.

How do I make a PDF non editable?

By protecting it with a PDF DRM solution with Locklizard Safeguard. As we have covered in detail in how to make a PDF non editable, Adobe Acrobat protection does not stop editing and nor do data rooms, Google Docs, etc.

Can Locklizard protect my Microsoft Office or Google Docs files?

No.  We only protect files in the PDF format.  Follow this guide to convert Word to PDF before using our DRM software, or see how to change a Google Doc to a PDF.

Can you add pages, text or a stamp to a secured PDF?

Once you have created a secure PDF file using Locklizard you cannot add pages or text to it.  You must do this before you protect it.  You can however add a stamp to a PDF during the protection process including adding a date/time stamp.

How can you add security on a PDF file without purchasing?

There are many free PDF editor apps that enable you to add security protection to a PDF document.  However they all use password protection which is useless:

1. weak passwords can be easily cracked
2. you have to find a way to share passwords securely and manage them
3. authorized users can simple remove the password and share an unprotected copy
4. restrictions or permissions can be instantly removed using free password recovery tools