How to protect a PDF from copying, printing and editing
Almost everyone starts in the same place: open the PDF in Acrobat, find the security settings, untick printing and copying, save. It takes two minutes and it feels like the job is done. It is worth understanding exactly what those two minutes bought you, because for most documents the answer is very little.
This guide covers what the built-in PDF controls actually do, why they come apart, and what enforced print and copy control looks like when the rules are checked at every open instead of politely requested.
What the built-in PDF settings really do
Permission flags: a request, not a rule
The "restrict editing and printing" options in Acrobat set permission flags inside the file. Those flags are an instruction to whatever application opens the document. A well-behaved reader honours them. A reader that chooses not to — and plenty do not — simply ignores them, and free online tools strip the flags in seconds without needing the password.
Nothing about this is a secret or an exploit. The flags were designed as a courtesy mechanism in an era when everyone used the same reader. They are still useful for signalling intent to a cooperative colleague. They are not a control you should rely on for anything that has commercial value.
Owner passwords and user passwords
A PDF can carry two passwords. The user password is needed to open the file at all; the owner password gates the permission settings. The user password is real encryption and does genuinely stop someone who does not have it. The problem is what happens next: the person you sent it to has the password, and the moment they open it they can save an unlocked copy, print it, or forward the file and the password together. A password answers "who opens the first copy" and says nothing about the second.
Flattening, rasterising and other one-way tricks
Converting text to images stops copy-paste and makes a document meaningfully harder to reuse. It also breaks search, accessibility and screen readers, inflates file size, and does nothing to stop printing or forwarding. Optical character recognition turns a rasterised page back into text in one pass. This trades a great deal of usability for a delay, not a control.
What actually changes the picture
The step that changes the outcome is not a stronger setting on the file. It is not sending the file. When you deliver controlled access to a document instead of the document itself, the rules stop being a property of a copy and become a property of the document, checked each time somebody opens it.
Four things become possible at that point, and they are the ones worth evaluating any platform on:
- Print and copy rules that are enforced at open, not requested. The policy is evaluated by the viewer that has the decryption key, so ignoring the rule is not an option the reader application gets to take.
- Recipient watermarking. Each rendering carries the name of the person it was issued to. This is the control that does the most work in practice, because it changes the social calculus of forwarding.
- Time-based access. Access ends on a date, after a set period, or when an enrolment or membership ends — including on documents already delivered.
- Device authorization and access records. Limit how many devices a reader may use, and see what was opened, by whom and when.
Matching the control to the document
Not every document needs all of this, and over-controlling a document has a real cost in friction and support tickets. A rough guide:
- Internal drafts among colleagues. Permission flags and a shared drive are fine. The threat model is confusion, not piracy.
- Priced content sold to individuals — reports, courseware, standards, study guides. Recipient watermarking plus print and copy rules. The buyer must not become the distributor.
- Time-bound material — exam prep, pre-release research, tender documents. Add time-based access so the document stops working when its window closes.
- Material tied to a paid relationship — member benefits, enrolled learners. Add device limits and revocation so access tracks the relationship rather than outliving it.
What none of this does
No document protection stops a phone camera pointed at a screen, and no honest vendor claims otherwise. A determined person with a phone and time will get a usable copy of anything they can legitimately read. That is a fixed property of showing information to humans, not a gap in a product.
What controls change is the cost and the traceability. Casual redistribution — forwarding an attachment to a colleague, posting a file in a group chat — is the overwhelming majority of what actually happens, and that is exactly what controlled delivery stops. The remainder becomes deliberate, effortful, and attributable to a named person. That is a reasonable goal. Absolute prevention is not, and no vendor can deliver it.
Our security overview sets out the same limits in more detail, including what we do not claim.
Where MyPass DRM fits
MyPass DRM delivers controlled access rather than files. Recipients open documents in a browser with no installation, and the policy — recipient watermarking, print and copy rules, time-based access, device authorization — is evaluated at every open, so a change applies to documents that are already out. Every open is recorded. All of it is also available through a public REST API if the content lives inside a platform you have built.
Where we are honest about fit: if your requirement is an installed desktop viewer enforcing policy with no network connection at all, an installed-viewer platform suits you better than we do. What document DRM costs compares the published prices across the market, ours included.
Common questions
Inside a controlled viewer, yes — copy can be disabled by policy, and the policy is checked every time the document is opened rather than trusted to the reader application. What no system stops is a person retyping a paragraph or photographing the screen. Treat copy control as removing the easy path, not as making extraction impossible.
They are requests, not enforcement. The standard PDF permission flags ask the reader application to behave; many readers ignore them, and free online tools strip them in seconds. They are useful as a statement of intent and useless as a control.
A password controls who opens the first copy. Once the file is open, the reader can save, print and forward an unlocked copy, and the password travels with the file in the next line of the email. Document DRM controls what happens after opening, and the policy stays attached to the document rather than to a secret you shared.
With a static file, no — the copy in someone else's inbox is frozen the moment it is sent. With policy-based delivery the rules live with the document rather than in the copy, so shortening access or revoking a reader applies to documents already delivered, without re-sending anything.
No, and any vendor who says otherwise is overselling. A person can photograph a screen with a phone. What recipient watermarking changes is attribution: the photograph carries the name of the person the document was issued to, which makes a leak traceable rather than anonymous.