Skip to main content

​
Overview

PDF files can carry an open password (also called a user password or document open password) that prevents the file from being read without it. Enclave detects these files automatically and prompts you for the password before the upload starts — so the built-in DLP scanner can analyse the content and apply watermarks without leaving the file in a permanently unreadable state.
This page covers password-protected PDFs. It is unrelated to Enclave’s own encryption, which always applies on top of and independently of any PDF-level password.

​
Uploading a password-protected PDF

When you select a PDF file for upload — whether through My Files or a Secure Room — Enclave runs a quick local probe using the same PDF rendering engine used by the browser viewer. If the file requires a password to open, the upload dialog shows a password field before the upload can proceed.
1

Select the file

Open the upload dialog in My Files or a Secure Room and choose your PDF. While you browse for a file, Enclave probes any selected PDFs in the background.
2

Enter the document password

If the PDF is password-protected, an amber password field appears in the upload dialog. Enter the open/user password — the one the PDF author set when they created or secured the document.The upload button remains disabled until you provide the password. If you are uploading multiple files at once, only the files that need a password are blocked; the rest proceed normally.
3

Upload and scan

Once you confirm the password, Enclave uploads and encrypts the file as normal, then passes the password (over your existing encrypted connection) to the DLP scanner. The scanner uses it to open the PDF for policy checks and watermarking, then discards it.
4

File becomes available

After scanning completes, the file appears in your file list with its usual status. The PDF password is not stored anywhere — neither by Enclave nor in the file’s metadata.
The password you enter is the PDF’s own open/user password — the one set by the document author. It is not your Enclave account password or your room passphrase.

​
What happens if you skip the password

If you close the upload dialog without entering a password, the upload does not proceed for that file. No partial upload is created. If the upload was started through an automated flow or the probe fails (for example, because the browser cannot load the PDF engine), the file may reach the server without a password. In that case, the DLP scanner cannot open the file and it is placed in a Password Required state: To unlock the file:
  1. Open My Files or the Secure Room where the file was uploaded.
  2. Find the file — it shows a Password Required badge.
  3. Click the badge (or the file’s action menu) and enter the open password.
  4. Enclave resubmits the file to the DLP scanner with the password. Once scanning finishes, the file transitions to Available.

​
Viewing a password-protected PDF in Enclave

Enclave’s in-browser PDF viewer also respects document-level passwords. When you open a password-protected PDF, the viewer shows an inline password prompt:
  1. The viewer detects that the file requires a password and displays a prompt card inside the preview area.
  2. Enter the open password and click Unlock.
  3. If the password is correct, the PDF renders immediately.
  4. If the password is wrong, the prompt reappears with a “Incorrect password, try again” message.
  5. If you dismiss the prompt without entering a password, the viewer shows a standard “Failed to render PDF” error instead.
The password you enter in the viewer never leaves your browser. It is passed directly to the browser’s PDF rendering engine (PDF.js) to decrypt the file locally — it is not sent to Enclave’s servers.
The viewing password and the upload-time password are used for the same underlying document, but they are entered in different places and serve different purposes:

​
Security properties

​
Frequently asked questions

What is the “open password” / “user password”? PDF supports two passwords: an owner password (controls editing permissions) and an open password (also called the user password — required to open and read the file at all). Enclave needs the open password. If a PDF opens in Adobe Reader or another viewer after typing a password, that is the open password. I do not know the PDF’s password. What should I do? Contact whoever created or shared the PDF. Without the open password, neither Enclave nor the DLP scanner can read the file’s contents. The file will remain in Password Required status until the correct password is provided. Can I change the PDF’s password after uploading? Enclave does not modify the PDF’s own password protection. If you need to change the document’s open password, update it locally using a PDF editor, delete the old file from Enclave, and re-upload the updated version. Does the password affect who can download the file? No. Enclave’s access controls (room membership, clearance levels) are enforced independently of the PDF’s own password. An authorised Enclave user can download the encrypted file regardless — but they will need the PDF’s open password to open it in their own PDF reader. What if the PDF was scanned successfully at upload but prompts for a password in the viewer? This is expected behaviour. The DLP scan uses the password server-side during upload. The browser viewer is a separate client-side operation — it needs the password again to render the file locally. Enter the same open password you provided at upload.