BASALT · JOURNAL
Why is my PDF locked? How to check what protects it on a Mac
When a PDF is called locked, it usually means one of two kinds of encryption: an open password that stops anyone viewing the file, or an owner password that lets the file open but restricts printing, copying or editing. A lock icon, a "you do not have permission" message and a password prompt can each come from a different one. Two other things get the same name and have nothing to do with a password.
The confusing part is that an owner-password file is encrypted and still opens with no password at all. That's why a PDF can show a lock, refuse to print and yet never ask you for anything. Which kind you have decides what you can do about it.
The four things people mean by locked
An open password, also called a user password, is the strict one. The file is encrypted and the content can't be read until the password is supplied. Preview asks for it before showing a single page.
An owner password with permissions is the second kind. The file opens without a password, but the author set flags that say whether printing, copying text, editing or annotating is allowed. On macOS 15, Preview reacts with messages such as "Without the proper password, you do not have permission to print this document." A matching message covers copying portions of it. Both are followed by "Would you like to enter a password for the document?" Saving can fail with "This document is encrypted and cannot be saved."
The third is the Locked checkbox in a file's Get Info window in Finder. It's a file-system flag on the file, and the PDF inside isn't encrypted or changed. A locked file can still be opened and read. It just can't be changed until it's unlocked, and Finder asks before moving it to the Trash.
The fourth is a signed document. After someone signs, the author may have set the form so that fields can't be changed, or the signature itself may flag any later change. That's a property of the signature, covered in how to verify a PDF signature.
What the protection looks like inside the file
An encrypted PDF has an /Encrypt entry in its trailer, pointing to a dictionary with the encryption settings. The standard security handler stores a user password check, an owner password check and a number, /P, whose bits are the permission flags. Nearly every string and stream in the file is encrypted, which is why a raw search of such a file finds almost nothing readable.
The encryption itself comes in generations. AES encryption arrived in PDF 1.6, and the oldest files used 40-bit RC4. In the output of qpdf --show-encryption, R = 6 means AES-256 and R = 2 means 40-bit RC4.
One more thing matters here: permissions are an instruction to the reading software, not a barrier. A reader that honors them refuses to print or copy. They don't protect the content from someone determined, and this post isn't about getting around restrictions on files that aren't yours. If you need to open your own file, removing a password you know is the route.
How to check on a Mac
Start with Preview, which needs no tools. Open the file and choose Tools > Show Inspector, then pick the Encryption pane. Apple describes it as showing "encryption and permission information for a password-protected PDF." If the file needs an open password, Preview asks for it first.
For a second opinion from Terminal, ask Spotlight what it can read without opening the file:
mdimport -t -d2 document.pdfLook for kMDItemSecurityMethod. On macOS 15 it reads None for an unprotected file and "Password Encrypted" for an encrypted one, and here's the surprise: a file with only an owner password reports "Password Encrypted" even though it opens freely, and its text is still indexed. A file that needs an open password gives Spotlight nothing at all, so no page count, no title and no security method. That blank result is itself the sign.
For the details, install qpdf with brew install qpdf. It only reads here.
qpdf --show-encryption document.pdfFor an unprotected file it prints "File is not encrypted". For an owner-password file it prints the R value, P value and a line for each permission, such as "print high resolution: not allowed", then the method (for example AESv3). For a file that needs an open password it begins with "Incorrect password supplied". If you know the password, add --password= followed by the password to read the permissions.
The same facts come out as structured data with a different command:
qpdf --json --json-key=encrypt document.pdfIt lists "encrypted", the method, the key length in bits and a capabilities block of true and false values.
Finally, to see whether the Finder lock is set, run this:
ls -lO document.pdfA locked file shows uchg in the flags column. That flag lives on the file, not in the PDF, so qpdf --show-encryption still says the content is not encrypted.
What to do about each kind
For an open password you don't remember, there's no recovery inside the file, and no honest tool guesses it for you. Check the email that came with the file, or ask the sender. If the password isn't accepted, a PDF password that isn't working lists the usual causes, such as a typed character that differs from the one in the original.
For an owner-password file you own, remove the restriction by supplying the password you set, or ask the author for an unrestricted copy. Lifting PDF restrictions on a Mac goes through the cases.
For the Finder lock, untick Locked in Get Info. For a signed form, ask whoever signed it for an unsigned original.
If you're the one setting protection, password protecting a PDF on a Mac explains the choices, and why a password isn't redaction explains why encryption isn't a substitute for removing content you don't want shared.
Frequently asked questions
How do I check if a PDF is encrypted on a Mac?
Open it in Preview, choose Tools > Show Inspector and look at the Encryption pane, or run qpdf --show-encryption document.pdf in Terminal. qpdf prints "File is not encrypted" for a plain file. If the file asks for a password before opening at all, it's encrypted with an open password.
How do I check if a PDF is password protected?
A file that asks for a password when you open it has an open password. A file that opens but refuses to print or copy has an owner password. On macOS 15, mdimport -t -d2 shows "Password Encrypted" for the second kind and nothing at all for the first, and qpdf --show-encryption lists the permissions of either.
Why does my PDF have a lock symbol?
Most often because the viewer found encryption or restricted permissions in the file, though the symbol doesn't say which. Open the Encryption pane in Preview to see what's permitted. A small padlock on the file's icon in Finder is different: that's the file-system Locked flag, not the PDF.
Why does my PDF keep asking for a password?
It's either an open password that you haven't saved anywhere, or an owner-password file where Preview offers "Would you like to enter a password for the document?" each time you try to print or copy. In the second case you can still read the file without entering anything. Entering the owner password lifts the restriction.
What does encrypted PDF mean?
It means the content of the file is scrambled with a key derived from a password, so software must supply the password to read it. For an owner-password file the open password is empty, so any reader can decrypt it without asking, and only the permission flags restrict what it does next.
Can a PDF be encrypted but open without a password?
Yes. If only an owner password is set, the user password is empty, the file opens freely and the restrictions apply to printing, copying and editing. On macOS 15, Spotlight reports such a file as "Password Encrypted" and still indexes its text.
Are PDF permissions a real security measure?
No, they depend on the reading software choosing to honor them. They stop casual copying and printing in readers that comply. They don't hide content from anyone who has the file, so anything truly confidential should be removed, not restricted.
Doing it in Basalt
Basalt has a Passwords tool for the cases above. It adds AES-256 encryption with an optional open password, an owner password and your choice of permissions for printing, copying text, editing and annotating, and it removes a password you already know. It never guesses or cracks passwords, so a file you can't open stays closed. Inspect also notes in a saved text report whether a file is encrypted.
Every tool writes a new file and leaves the original alone. The engine that opens documents has no network entitlement, and nothing is uploaded. Basalt is $29 once for up to three Macs, and you can try it free for 24 hours.
Redaction that proves itself
Basalt destroys the content you mark, then re-opens the file it wrote and proves the content is gone before it saves anything. Your documents never leave your Mac.
