Encryption and permissions when combining PDFs

"This PDF has a password" can mean two very different things, and they behave differently in a combine. The PDF specification calls them the user password and the owner password; together with a permissions bitmask, they form the /Encrypt dictionary in the trailer.

The user password — true encryption

If a PDF requires a password to open, every stream and string in the file is encrypted (RC4 in old files, AES-128 or AES-256 in modern ones). Without the password, a combiner cannot read the page tree, cannot extract text, cannot do anything except detect that the file is encrypted.

Password-protected PDFs typically cannot be merged: the underlying merge tool can't read them without the password, and the merge fails. If you have the password, open the file in a desktop PDF editor (Preview on Mac, Adobe Acrobat, or any other PDF tool that asks for the password and lets you re-save the file), save it without password protection, then upload the unprotected copy.

The owner password — permissions only

Far more common in the wild is the "permissions" PDF: it opens without a password, but the file claims certain operations require an owner password. The flags in /P are a 32-bit bitmask:

• bit 3: print allowed
• bit 4: modify contents allowed
• bit 5: copy/extract allowed
• bit 6: add/modify annotations
• bit 9: fill in forms
• bit 10: extract for accessibility
• bit 11: assemble (insert/rotate pages)
• bit 12: high-resolution print

The file is still readable. The encryption is symmetric — bytes are scrambled — but the user-password hash matches the empty string, so any reader can open it. The flags are advisory: a polite viewer (Acrobat, Preview) will gray out "Print" or "Copy text" if the flag is unset; a determined PDF library can ignore them.

What happens with permission-only files

An input with only owner-password protection (no user password) is readable by any tool. Whether the merger honors the "assemble" permission flag and refuses to include the file, or ignores it and produces an unprotected output, depends on the tool. In practice, owner-password "permissions" are commonly ignored by PDF processing libraries — they are sometimes called "social copy protection" — so a combine of such files generally produces a merged PDF without the original /Encrypt dictionary.

This is consistent with how nearly every PDF tool behaves and matches the law in most jurisdictions: owner-password "permissions" are honored as a polite default by readers, not as cryptographic enforcement.

The combined PDF is not password-protected

The merged PDF has no /Encrypt dictionary unless one is explicitly added afterwards. If you need the result to require a password or carry permission flags, apply them after combining with a dedicated tool:

Open the combined PDF in your PDF reader and use its "Protect → Encrypt with Password" dialog (Adobe Acrobat, Foxit, and similar full-featured readers all expose this). Setting the user password requires re-encrypting every stream, which a combiner does not do as part of merging.

Signed PDFs

A PDF can carry a digital signature in a form field that covers a byte range of the document. The signature commits to a specific hash of the file contents at signing time. Any modification — including a combine — invalidates the signature, because combining inherently changes the bytes.

Signed PDFs lose their digital signatures during a combine. The signature field is either dropped or kept as data while marked invalid; a recipient who verifies will see "Signature invalid" or "Signature not present" depending on how the field is preserved.

If you need to combine a signed PDF with other content while preserving the signature, the only option is to use PDF's "incremental update" mechanism: append new pages without rewriting the existing structure. This is a different operation from combining and is not what most tools (including this one) implement.

Redaction and confidentiality

If your input PDF has had black rectangles drawn over sensitive text via Acrobat's "Redact" feature, the redaction was applied destructively (text replaced) only if the file went through "Apply redactions". A black rectangle drawn as an annotation overlay is reversible — the original text is still in the file. A combine preserves whatever is actually in the file, so:

• True redactions (text removed) survive.
• Cosmetic redactions (rectangle annotations on top) survive — and the underlying text remains extractable from the combined output.

If you're combining files with sensitive content, verify your redaction tool actually removes the text before combining.