Batch PDF encryption with AES-256 and granular permissions

The two passwords

User password and owner password do completely different things

PDF supports two distinct passwords on the same file, and confusing them is the most common mistake people make with PDF encryption. They protect different things and serve different threat models.

USER PASSWORD (open password)
  Required to open and view the PDF.
  Without it, the file is unreadable — encrypted on disk, no preview.
  Use when: only authorized recipients should see the document at all.

OWNER PASSWORD (permissions password)
  Holder can change permissions and remove encryption.
  Anyone can open the file with their existing reader, BUT
  the file enforces the permission flags you set (print, copy, edit, etc.).
  Use when: the document can be read freely, but only certain
  actions are allowed unless someone holds the owner password.

BOTH SET
  Most restrictive. User password to open, owner password to bypass restrictions.

A common misconception is that the user password is "the password" and the owner password is some kind of admin override. They are different mechanisms. Most public-distribution scenarios (web-published reports with no copy/edit) need an owner password and no user password — you want everyone to read the document, you just don't want them to copy text out.

Encryption

AES-256 in the PDF 2.0 V=5/R=6 handler

PDF defines its encryption handlers by two version numbers: V identifies the algorithm and R the password-handling revision. The PDF spec has gone through several iterations — V=2 R=3 RC4-128 (1.4 era, weak by modern standards), V=4 R=4 AES-128 (1.7 era, OK), V=5 R=5 AES-256 (1.7 ExtensionLevel 3, with a known weakness), and finally V=5 R=6 AES-256 (PDF 2.0, the current strong standard).

PDF Batch Editor encrypts using V=5 R=6: AES-256 in CBC mode, with key derivation that uses a salt and a high iteration count to resist password brute-force. This is the same encryption handler used by enterprise document management systems and government archives. Older readers (pre-Acrobat X / pre-2011 software) won't open V=5 R=6 files; modern Acrobat, Foxit, and most PDF libraries handle it transparently.

Granular permissions

Six flags, four presets, one custom mode

The other direction

Batch decrypt to remove existing protection

Sometimes the job is the reverse: an inherited archive of password-protected PDFs that need to be migrated to a new document management system, or a batch of forms that arrived encrypted from an external partner and need to be processed downstream. Decrypt mode removes the encryption layer from each file in the batch.

You must supply the correct user or owner password — PDF Batch Editor doesn't crack passwords, doesn't have a recovery mode, doesn't bypass them. With the correct password, the file decrypts cleanly and the output is a regular unprotected PDF. Without it, the file is skipped and the operation log records the failure. This is intentional: if a tool can decrypt PDFs without the password, the encryption is meaningless.