PDF Protection: protect PDF files – stop printing, copying, save as, editing

  How to stop PDF sharing / protect PDF from sharing

Safeguard PDF Security and Enterprise PDF DRM provide PDF protection by using encryption, DRM, and licensing controls.  These document controls stop PDF sharing and printing, protect against copying, prevent editing, and enable secure distribution of your PDFs.

Safeguard’s PDF protection provides many security features and in-built restrictions to protect PDFs, and unlike Adobe restrictions, these cannot be removed.  Most of the basic protection features are applied by default (stop PDF copying, editing, screenshots, etc.) whereas others you can change to suit your requirements (allow or stop PDF printing, enforce expiry, etc.).  All of these security restrictions stop PDF files from being shared with unauthorized users, control how they are used, and how long for.  A list of these PDF restrictions are provided below.

Safeguard does not use passwords to protect PDFs since users can easily remove password protection from a PDF.  Instead PDFs are protected using individual encryption keys that are securely and transparently relayed to authorized devices from a web server and stored encrypted in a keystore on the local device.  The keystore is locked to individual devices so it cannot be copied and moved elsewhere.

Safeguard’s secure PDF Viewer is required to open secured PDF files.  This can either be installed on a device (Windows, Mac, iOS, Android), run from a USB stick (completely offline zero installation solution), or accessed via a web browser (zero installation).  When a user opens an encrypted PDF document, the Viewer checks to see if the decryption key is available.  If it is not present then the Viewer checks with the administration server to see if the user is authorized to view the PDF.  If they are, the decryption key is transparently relayed to the client and the protected document opens.  DRM controls are enforced by the Viewer software.

  Stop PDF Printing / Protect PDFs from printing

Safeguard protects PDFs from printing – it disables printing of PDF documents by default so you do not have to apply any additional controls to stop a PDF being printed.  As well as using Safeguard to stop PDF printing for specific (or all) documents, you can stop printing on a per-user basis. This lets you disable it for some users but allow it for others using the same protected document (you don’t have to distribute a new document with different protections for each user). Documents can be secured with zero prints available (to stop PDF being printed) and then individual users can be granted print rights by altering the number of prints available.

If you allow printing, you can limit the number of times a PDF can be printed by each user to stop users distributing high-quality copies of documents to others.  You can also enforce black & white or grayscale printing of color documents.  Document watermarking is recommended if you allow printing to discourage photocopies from being made – see PDF watermarking below.

Safeguard’s PDF protection disables print to PDF and other file printers so that if printing is allowed, users cannot print to PDF files, XPS, or any other file format.

   Stop PDF Copying / Protect PDF against copying & distribution

How can you stop PDF copying since anyone can easily copy a digital file?

The important issue is not whether you can stop a PDF from being copied, but whether the recipient of the copied file can use it.  If you encrypt a PDF with a password, you can give a copy of the PDF to another user along with the password and they can use the file.  So, the protection provided is worthless – a useful copy was made that could be used by others.  Safeguard effectively stops PDF copying.  The protected file is of no use to another user without the decryption key required to open it.  Decryption keys are stored encrypted in a keystore which is locked to the device it was registered on – so only authorized users can open protected PDFs.

Authorized users must be prevented from saving the PDF in an unprotected format (so no editing or saving options should be made available) and unprotected files should never be stored on disk in temporary files where they could be easily recovered.  For additional security the PDF Reader should prevent screen grabbing, and document owners should disable printing so photocopies cannot be made of printed documents.

So, to protect PDFs from copying you have to encrypt the PDF files to stop unauthorized access, use licensing controls to lock documents to devices, and apply DRM controls to constrain document usage so they cannot be easily shared.

To protect PDF files from content copying see the section entitled “Protect PDF against content & text copying”.

   Preventing Saving PDF / Save As

If you are going to prevent document sharing and editing then you have to stop ‘Save As’ from being used.  Otherwise, PDF documents can be saved in unprotected formats.  The simplest way to do this is to not have the facility available to begin with.  Some products use JavaScript to disable the Save As menu item or shortcut-keys, but JavaScript can be easily removed (or turned off) in a browser environment, so it cannot be used securely.

Unlike Adobe Acrobat Reader, Safeguard’s PDF protection has no ‘Save’ or ‘Save As’ functionality in its secure PDF Viewer.  The only documents that can be copied are secured PDFs, and they are useless to unauthorized recipients as they need the correct decryption keys to open them.

Because ‘Save As’ options are not made available, Safeguard’s Secure PDF Viewers automatically stop PDF conversion to Word and other file formats.  Users cannot convert protected PDFs (PDC files) to Word using external applications either, as the files are encrypted and can only be processed by Safeguard Secure PDF Viewers.

  Disable or Prevent PDF Download

Stopping PDFs from being downloaded (the ability to disable or prevent PDF download) is very similar to preventing copying in principle.  People think that if you allow users to view secure PDF documents online then they are more secure because they cannot be manipulated on a device outside of the ‘secure environment’.  You might want to think again.  The way every browser works is by caching information to disk.  And browser environments are possibly the least secure of all because if no software is installed on a device, you have no control over the actual environment (so stopping screen grabbing and printing to file drivers is not possible).  See Secure Downloads for additional information on stopping downloads and copying.

Most secure data room systems disable PDF downloads because the downloaded PDF files contain NO protection apart from a watermark that can be easily removed in a PDF editor.  To stop the browser caching the PDF on the user’s system, they convert your PDF files to images when you upload them – so the document is no longer a PDF file but consists of just raster images.  However, this provides a poor user experience since images are slow to display and print, and features such as search, bookmarks, and annotations are unlikely to be available.  If you allow the user to download the PDF it is then converted back to a PDF file again.  Further, users can still screenshot the document and convert it back to text with an OCR tool.

However, if you encrypt a PDF file and the user does not have the decryption key to use it, it does not matter if they can download it.  They won’t be able to open it anyway.  And if you apply DRM and licensing controls then authorized users (those given access) will be restricted as to what they can do with downloadable PDF files (for example not being able to share them with others).  So, the ability to download a PDF file does not make it any less secure – in fact, many online PDF Viewers that ‘prevent downloads’ are less secure since they decrypt PDF files on the server and deliver (download) them to the client in an unprotected form.

Safeguard’s installed Viewers let users download secured PDFs while enforcing all DRM controls, leaving no reason to disable or prevent PDF downloads.

   Stop PDF from being Forwarded / Emailed

You cannot stop PDF files from being forwarded or emailed to others, but you can stop the recipients from using those files – see ‘Stop PDF Copying’ above.

Many cloud-based systems claim to stop PDF forwarding.  However, users can share their login credentials with others to give them access to your documents anyway.  If a system uses document links, then there is nothing stopping an authorized user from emailing those links to other users along with the login information.  Some systems state that they lock PDF files to email addresses or domains but that just means that you have to login using that email address or any email address that belongs to the domain.  It does not stop PDF forwarding since authorized users can still give their login credentials to others.  That is also true of 2FA codes which provide little extra protection.

A Safeguard-protected PDF file can be forwarded and emailed to another user but the recipient will NOT be able to view it unless the document owner has authorized them to use it.

If you are the document publisher, you can email secure PDF files to users knowing that if they fall into the wrong hands they cannot be opened.  If a secure PDF is accidentally forwarded to the wrong person they will not be able to use it in any way.  See also stop copying, downloading and emailing.

  Stop PDF Editing / Lock PDF so it cannot be edited / Block PDF from editing

Adobe Acrobat has ‘security’ features built-in that let you stop PDF editing (restrict editing PDF or stop PDF modifying), printing, and saving.  To enable these features in Acrobat (and block a PDF from editing) you have to apply a permissions password to protect the PDF.  The problem, however, is that the password you set (no matter how long) is completely useless.  It is no more effective than putting a watermark on the document that says ‘Please do not edit or copy this PDF’.  This is because there are numerous free and paid for PDF password remover programs on the internet that will remove Adobe Acrobat permissions passwords in seconds.  Adobe restrictions do not really disable editing in PDF files since PDF restrictions can be easily removed by users.

Safeguard stops PDF editing / modifying by default – it will lock a PDF so it cannot be edited and blocks all forms of content copying.  No option can be enabled in our Secure PDF Viewers for users to edit PDF files or copy/paste PDF content, thus protecting PDF files from editing.  By disabling the editing of PDF files you also stop content / text copying.  Safeguard Secure PDF Viewer also disables editing of PDF forms – so form content (fields) cannot be edited or modified in any way , but form fields can still be filled in – see secure PDF forms.

Users can still add comments to PDF files (if you allow this option), but PDF content is always protected from editing, ensuring that your original content cannot be altered in any way.

   Make text in PDF not searchable / Make text not selectable

If you search for how to make a PDF not searchable or selectable, the results will mostly suggest flattening your PDF pages to images.  This works to an extent.  Displaying pages as images makes a PDF text not searchable or selectable using cursors and touch screens.  However, many do not realise that this process is reversible.  Optical character recognition (OCR) tools analyze the shape of each character in the image and check them for matches in their database.  The character is then replaced with real, editable text.  Modern OCR tools even use AI neural networks and machine learning to accurately detect and convert images of text in a wide variety of scenarios.

OCR tools are built into many PDF readers.  Sometimes, the OCR reader even kicks in automatically as soon as users open a flattened PDF for additional convenience.  Mobile and desktop, and browser OCR apps are also available, so hosting a PDF online does not prevent OCR either.  If you truly want to make a PDF not searchable or text not selectable, use Safeguard.  Our in-built flattening feature allows you to easily convert PDF content into images and then protect them against opening in other PDF applications which may have OCR tools.  Instead, users utilize Safeguard’s Secure Viewer application, which further prevents OCR by stopping screenshots and screen recordings.

   Protect PDF against content & text copying

In some PDF protection products, if editing is disabled you can still highlight and copy text.  Safeguard makes text in a PDF not selectable – it stops users from copying text and other content within a document.  There is no copy-paste option available and text cannot be highlighted for selection (text is not selectable, nor are images) so it cannot be copied and pasted.

  Stop Screenshots / Protect PDF from screen capture

Many PDF DRM products claim to stop screenshots, but, if you look closely, mainly claim to prevent Windows print screen.  There are many free screen grabbing or screen capture applications available that users can download to easily bypass this restriction.

Safeguard stops screenshots from being taken by both Windows and third-party software applications.  It uses many different methods including a screen mask that is overlaid over the secure PDF document if the mouse cursor is moved to another active application.  No PDF DRM product however can stop all screenshots (users can just take photographs of the screen) so it is recommended that document publishers apply dynamic watermarks as a copying deterrent.  If a user’s name and email are displayed on a screenshot, they will probably be less likely to share it with others (especially on the internet where they can be easily identified).

  PDF Expiry and expiring PDF files

Safeguard enables document publishers to expire PDF files so they can no longer be used after a certain amount of time.  The following options are available:

• expire documents on a fixed date
• expire documents after a number of days
• expire documents after a number of opens or views
• expire documents after a number of prints

These options can be used together so that you can enter a number of days/views/prints and a fixed date and whatever occurs first causes the document to expire.  You might, for example, want a user to be able to use your documents for a 15-day trial period, but have those documents expire on a fixed date regardless of whether the trial period is used or not.

Expiry dates can be changed on the administration system at any time and document publishers can increase the number of views/prints available for each user.

   Revoke PDF Files

Being able to revoke PDF files is an important part of any document security solution.  There may be times when the wrong document was published, a user has left your company, or you think a specific document has been compromised.

Safeguard lets you revoke PDF files instantly (when the document is set to check with the administration system each time it is opened), or specific users (so that all documents they have access to become inaccessible).  If you have created PDF files that only check with the administration system every n days, then PDF revocation will only take place once a check has occurred.  With Safeguard, PDF files can be revoked no matter where they are located.  You can also revoke access to multiple PDF files instantly and group documents into publications to make revocation easier for common groups of documents.

   PDF Watermarking

No DRM system is foolproof.  Even if screenshots are prevented, users can take photographs of the screen using a camera.  Similarly, if you allow printing, users can print and scan back in printed documents.

To discourage users from making copies of protected documents, you can add dynamic PDF watermarks to viewed and/or printed content.  By using dynamic variables, you only have to protect a PDF once for all users (rather than watermarking and protecting each document individually for each user in Adobe Acrobat) as user data (name, company, email, date/time, etc.) is  inserted at view/print time.

Safeguard’s PDF protection lets you position dynamic PDF watermarks anywhere on the page (including custom locations) and choose your own font and color.  You can use different watermarks for viewed and printed documents and both text and image watermarks are supported.  PDF watermarks can be displayed behind content (so they are less obtrusive to the user), and you can choose not to display watermarks on the first page of a document if you have a cover image that you want to leave unmarked.

Unlike Adobe watermarks or those added using other PDF editing tools, Safeguard’s watermarks are permanent and cannot be easily removed.  See How to remove a watermark from a PDF.

   Lock PDFs to country locations, domains and IP addresses

In addition to Safeguard’s ability to lock PDFs to individual machines (so that they cannot be used on unauthorized devices), you can lock PDFs to specific countries, a domain or an IP address range.

This is done at the user level or a global level (for all users).  In this way, you can easily restrict all users to viewing secured PDFs from say your office location in the US.  This is particularly useful if users have laptops that they are allowed to take home – locked PDF files can then only be viewed at the office and not when the user is at home or at other locations where they could be shown to others.

  Track PDF use

Safeguard Enterprise PDF DRM lets you track PDF use so you can see when users have viewed and/or printed your PDF files.

This is useful if you want to check whether a particular user has viewed a document yet – especially if they claim to have not received it.  Tracking PDF files requires users to be connected to the internet since a record has to be stored on a cloud server when a PDF file is viewed/printed.  You may therefore only want to track PDF use for specific documents otherwise users will have to be constantly online.

   Secure PDF Hosting & Secure PDF Distribution

Locklizard provides secure PDF hosting with Web Publisher (secured PDF files are stored on a cloud server either hosted by Locklizard or yourselves).  Alternatively, you can distribute PDF files securely as you would any other file.

Many providers offer secure PDF hosting or enable you to secure PDF files online, but these are not as secure as you may think.  Most cloud-based PDF DRM systems for example offer ‘secure PDF hosting’ but protect PDF documents online on a cloud server.  Your unprotected PDF files are uploaded to a server where they are stored, encrypted and DRM controls applied, before being stored again in protected format.  This may be fine for ebooks but what about sensitive and confidential company documents?  Do you really want them sitting on a server in an unprotected format for any length of time?  Safeguard’s PDF protection cloud-based PDF DRM system generates secure PDF files locally (encryption and DRM controls applied) and then uploads them to a cloud server so they can be viewed by users in a browser.  Your PDF files can never be compromised by server vulnerabilities as they are encrypted locally, uploaded via SSL, and stored encrypted on the server.

If you prefer to host secure PDF files yourself then you can distribute them just like any other file (email, USB, web site download, etc.).  Safeguard generates PDC files (secure PDF format) that can only be opened with our secure PDF Viewers.  It does not matter who has access to your secure PDF files because they are encrypted and can only be viewed by authorized users.  So, you can make them freely available via a web site for download without worrying about password access controls.

For completely offline secure PDF distribution you can protect PDF files to USB sticks using Safeguard PDF Portable.  This enables you to distribute our secure PDF Windows Viewer, secure PDF documents, and a keystore on USB sticks for offline viewing.  Additional secured PDF documents and decryption keys can be added at a later date by authorized users when they become available without the USB stick having to be returned to you.

The administration system (where you create users and authorize document usage) can be hosted by Locklizard or on your own servers.  This is separate from the protection of PDF files (which is done locally on your computer), so you have greater control over the secure distribution of your documents and who has access to them.

   Batch PDF Protect with command line

Safeguard enables you to batch protect PDF files using a command line tool.  Using this PDF security tool, multiple administrators can protect PDFs in a consistent manner, apply PDF protection quickly, copy to multiple folders, and schedule PDF protection based on certain events or a date/time.  Using the command line, administrators don’t have to learn what DRM security controls to apply – they just run a batch file.

Safeguard also lets you automate administrative functions (adding users, assigning document access) using our ecommerce API.  This enables companies to delegate admin controls by creating simple interfaces where specific functions are made available.  You can also automate user creation and document access after a purchase has been made online (e.g. a secured PDF ebook).