Passwords, Redaction, and Watermarks: A Plain-English Guide to PDF Security
Published August 2026
"PDF security" gets used as a catch-all term, but a password, a redaction, and a watermark protect against three completely different threats. Using the wrong one — or assuming one does the job of another — is how sensitive information ends up exposed even when someone thought they'd secured it.
Passwords: control who can open the file at all
A password answers one question: can this person open the file? Add one with Protect PDF and only someone with the password can view the document at all. It does nothing to the content itself — once someone has the password and opens the file, they see everything exactly as it was. If you legitimately own a PDF and lost or need to remove its password, use Unlock PDF.
Good for: preventing an unauthorised person from opening a file at all — a contract
attached to an email that gets forwarded, a document on a shared drive.
Not good for: hiding specific information from someone who is allowed to open
the file.
Redaction: permanently remove specific information
Redaction answers a different question: can everyone who opens this file see this one paragraph, number, or photo? Real redaction — like our Redact PDF tool — deletes the underlying text or image data in the area you cover, not just draws a shape on top of it.
The mistake that keeps happening: drawing a black rectangle over text in a PDF viewer or presentation program without actually redacting it. The text is still there underneath — selecting it and copying it, or opening the file in a different program, can reveal exactly what was "hidden." This has caused real, embarrassing data leaks for governments and companies. If you need information gone, it has to be genuinely deleted from the page data, not covered.
Good for: hiding a social security number, account number, or signature before
sharing a document — while still letting people read everything else.
Not good for: restricting who can open the file (a password does that).
Watermarks: mark or attribute, not protect
A watermark — added with Add Watermark — stamps text or a logo across every page. It's often assumed to be a security feature ("DRAFT," "CONFIDENTIAL," a company name), but it doesn't actually restrict anything: the underlying content is still fully readable, selectable, and copyable. A watermark communicates a status or origin; it doesn't enforce anything. If you've received a file with a watermark you need removed (for example, cleaning up a template before reusing it), Remove Watermark handles that.
Good for: marking a document as a draft, or attributing it to your organisation.
Not good for: preventing copying, editing, or redistribution — it does not do that.
Putting it together
For a document with sensitive sections that also needs to be restricted to specific recipients: redact the sensitive parts first, then add a password last. Adding the password first would block the redaction tool (and any other editor) from opening the file — you'd have to unlock it again before you could make any changes.
Frequently Asked Questions
If I password-protect a PDF, do I still need to redact anything?
Only if you don't fully trust everyone you're sharing the password with to see every part of the document. A password controls access to the whole file, not to specific sections within it.
Can a watermark be removed by anyone who receives the file?
If they have access to the right tools, yes — a watermark isn't a security control, just visible markup layered onto the page.
Is drawing a box over text in a PDF viewer the same as redacting it?
No, and this is the most common security mistake with PDFs. If the box is just a shape on top of the text, the text is still fully present underneath and can be recovered. True redaction deletes the underlying content.