Is your PDF actually encrypted? How to check before you send it

"Password-protected" and "properly encrypted" are not the same thing. A PDF can demand a password and still be trivial to crack — or quietly leak its metadata, embedded files, even JavaScript. If you handle contracts, health records, or anything under SOC 2 or HIPAA, that difference is the whole ballgame.

What actually makes a PDF secure

• The cipher. Older PDFs use RC4, which is broken. Modern ones use AES-128 or AES-256. If you see RC4, treat the file as effectively unencrypted.
• Key length. 40-bit and 128-bit RC4 are weak; AES-256 is the bar for genuinely sensitive data.
• Permissions. The document's permission flags decide printing, copying and editing — and are easy to set wrong.
• Leaks. Metadata, embedded files and embedded JavaScript can carry exactly the information the "protected" file was supposed to hide.

Check it in seconds — on your own device

The GG Pro PDF Security & Encryption Auditor reads a PDF locally in your browser — the file never leaves your machine — and reports the cipher, key length, permissions and any leaks, with a plain-English verdict. It's the fast pre-flight before you send a sensitive document, and the evidence you need when an auditor asks.