> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kvelden.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Password-Protected PDFs

> How Enclave handles PDF files that require an open password — at upload, during scanning, and in the browser viewer.

## Overview

PDF files can carry an **open password** (also called a user password or document open password) that prevents the file from being read without it. Enclave detects these files automatically and prompts you for the password before the upload starts — so the built-in DLP scanner can analyse the content and apply watermarks without leaving the file in a permanently unreadable state.

<Note>
  This page covers password-protected PDFs. It is unrelated to Enclave's own encryption, which always applies on top of and independently of any PDF-level password.
</Note>

***

## Uploading a password-protected PDF

When you select a PDF file for upload — whether through **My Files** or a **Secure Room** — Enclave runs a quick local probe using the same PDF rendering engine used by the browser viewer. If the file requires a password to open, the upload dialog shows a password field before the upload can proceed.

<Steps>
  <Step title="Select the file">
    Open the upload dialog in My Files or a Secure Room and choose your PDF. While you browse for a file, Enclave probes any selected PDFs in the background.
  </Step>

  <Step title="Enter the document password">
    If the PDF is password-protected, an amber password field appears in the upload dialog. Enter the **open/user password** — the one the PDF author set when they created or secured the document.

    The upload button remains disabled until you provide the password. If you are uploading multiple files at once, only the files that need a password are blocked; the rest proceed normally.
  </Step>

  <Step title="Upload and scan">
    Once you confirm the password, Enclave uploads and encrypts the file as normal, then passes the password (over your existing encrypted connection) to the DLP scanner. The scanner uses it to open the PDF for policy checks and watermarking, then discards it.
  </Step>

  <Step title="File becomes available">
    After scanning completes, the file appears in your file list with its usual status. The PDF password is not stored anywhere — neither by Enclave nor in the file's metadata.
  </Step>
</Steps>

<Warning>
  The password you enter is the PDF's own **open/user password** — the one set by the document author. It is not your Enclave account password or your room passphrase.
</Warning>

***

## What happens if you skip the password

If you close the upload dialog without entering a password, the upload does not proceed for that file. No partial upload is created.

If the upload was started through an automated flow or the probe fails (for example, because the browser cannot load the PDF engine), the file may reach the server without a password. In that case, the DLP scanner cannot open the file and it is placed in a **Password Required** state:

| File status           | Meaning                                                                                                                    |
| --------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| **Password Required** | The DLP scanner needs the PDF open password before it can continue. The file is not yet available for download or viewing. |

To unlock the file:

1. Open **My Files** or the **Secure Room** where the file was uploaded.
2. Find the file — it shows a **Password Required** badge.
3. Click the badge (or the file's action menu) and enter the open password.
4. Enclave resubmits the file to the DLP scanner with the password. Once scanning finishes, the file transitions to **Available**.

***

## Viewing a password-protected PDF in Enclave

Enclave's in-browser PDF viewer also respects document-level passwords. When you open a password-protected PDF, the viewer shows an inline password prompt:

1. The viewer detects that the file requires a password and displays a prompt card inside the preview area.
2. Enter the open password and click **Unlock**.
3. If the password is correct, the PDF renders immediately.
4. If the password is wrong, the prompt reappears with a "Incorrect password, try again" message.
5. If you dismiss the prompt without entering a password, the viewer shows a standard "Failed to render PDF" error instead.

<Note>
  The password you enter in the viewer never leaves your browser. It is passed directly to the browser's PDF rendering engine (PDF.js) to decrypt the file locally — it is not sent to Enclave's servers.
</Note>

The viewing password and the upload-time password are used for the same underlying document, but they are entered in different places and serve different purposes:

| Where entered     | Purpose                           | Sent to server?                     |
| ----------------- | --------------------------------- | ----------------------------------- |
| Upload dialog     | Enables DLP scan and watermarking | Yes — over TLS, discarded after use |
| In-browser viewer | Renders the PDF on screen         | No — browser only                   |

***

## Security properties

| Property                           | Detail                                                                                                                                                                               |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Not stored**                     | The PDF open password is never written to Enclave's database, audit log, or file metadata.                                                                                           |
| **In transit**                     | The password travels from your browser to Enclave's servers over TLS (the same connection that carries all Enclave traffic).                                                         |
| **Discarded after scan**           | The DLP worker uses the password once — to open the file for scanning — and does not retain it after the scan job completes.                                                         |
| **Viewer is local**                | The viewer password is processed entirely in your browser by PDF.js. It is never transmitted.                                                                                        |
| **Enclave encryption is separate** | Enclave's AES-256-GCM file encryption always applies independently of any PDF-level password. Both layers are active simultaneously for password-protected PDFs uploaded to Enclave. |

***

## Frequently asked questions

**What is the "open password" / "user password"?**

PDF supports two passwords: an *owner password* (controls editing permissions) and an *open password* (also called the user password — required to open and read the file at all). Enclave needs the **open password**. If a PDF opens in Adobe Reader or another viewer after typing a password, that is the open password.

**I do not know the PDF's password. What should I do?**

Contact whoever created or shared the PDF. Without the open password, neither Enclave nor the DLP scanner can read the file's contents. The file will remain in **Password Required** status until the correct password is provided.

**Can I change the PDF's password after uploading?**

Enclave does not modify the PDF's own password protection. If you need to change the document's open password, update it locally using a PDF editor, delete the old file from Enclave, and re-upload the updated version.

**Does the password affect who can download the file?**

No. Enclave's access controls (room membership, clearance levels) are enforced independently of the PDF's own password. An authorised Enclave user can download the encrypted file regardless — but they will need the PDF's open password to open it in their own PDF reader.

**What if the PDF was scanned successfully at upload but prompts for a password in the viewer?**

This is expected behaviour. The DLP scan uses the password server-side during upload. The browser viewer is a separate client-side operation — it needs the password again to render the file locally. Enter the same open password you provided at upload.