How to protect a distributed pdf form with permissions and flattening
- Step 1Confirm your form's goal — Outbound: recipients fill fields — keep modify enabled (the default here). Returned: lock the answers — that's a flatten step, not a permission step. Plan both phases.
- Step 2Open the Permission Setter and drop the blank form — Load the fillable PDF into the PDF Permission Setter. Free tier handles up to 2 MB / 50 pages.
- Step 3Set an owner password — Enter an owner password to mark the form as protected. It does not stop recipients opening or filling it — there's no open password set.
- Step 4Optionally block printing or copying of the blank form — Tick Block printing / Block copying only if you don't want the blank template printed or its text lifted. There is no form-fill-only switch — modify stays on so fields work.
- Step 5Distribute and collect completed forms — Recipients fill the fields in Adobe Reader (and can save if Reader-extension rights are present in the form) and return them to you.
- Step 6Flatten each returned form to lock the data — Run PDF Flatten on returned forms so the entered values become static page content that can't be changed, then archive.
Form workflow: what each step does
The Permission Setter handles print/copy; flattening handles locking the answers. There is no form-fill-only permission in this tool.
| Stage | Tool | What it does |
|---|---|---|
| Send blank form, keep fields fillable | PDF Permission Setter | Owner pw set; modify left --modify=all so fields work |
| Stop the blank form being printed | PDF Permission Setter — Block printing | --print=none |
| Stop text being lifted from the form | PDF Permission Setter — Block copying | --extract=n |
| Lock returned answers | PDF Flatten | Bakes field values into static content |
| Require login to open the form | PDF Password Protect | Sets an open password (not in this tool) |
Common misconceptions vs. reality
Form-distribution claims people expect, checked against the implementation.
| Expectation | Reality in this tool |
|---|---|
| 'Allow form-fill, block all other edits' | No such toggle — modify is always --modify=all |
| 'Block annotations only' | No annotation toggle; flatten to remove the layer |
| 'Recipients can fill but not delete labels' | Use PDF Flatten on the template's non-field content as a workaround |
| 'The form is locked after they fill it' | Only after you flatten the returned file |
| 'Set a fill-in-forms permission bit' | Not exposed; only print and copy bits are |
Cookbook
Practical form-distribution recipes that match what the tool can really do.
Send a blank HR form, fields stay fillable
An onboarding form recipients must complete. You don't want the blank template's boilerplate copied, but fields must work.
Owner password: hr-form-2026
Block copying: ON → --extract=n
Block printing: OFF → --print=full
Result: fields fillable (modify=all), text not copyable,
Acrobat flags the file as permission-protectedLock a returned application form
An applicant emailed back a completed form. You archive it as an immutable record by flattening the answers.
Tool: PDF Flatten Input: application-completed.pdf Output: application-locked.pdf field values → static text on the page no field can be re-edited
The qpdf invocation for an outbound form
Note that modify is left at all, which is exactly why fields remain fillable. Only copy is blocked here.
qpdf --encrypt "" "hr-form-2026" 256 \
--extract=n --print=full --modify=all \
-- form.pdf form-protected.pdf
^^^^^^^^^^^^^ fields stay fillableProtect template labels while keeping fields editable
If you fear recipients deleting instruction text, flatten only after building the form so labels become static — but do this before adding the AcroForm fields, since flattening a filled-in form bakes the field values too.
Authoring order: 1. Add instruction text / labels as page content (not fields) 2. Keep only the answer boxes as AcroForm fields 3. PDF Permission Setter → owner pw, Block copying ON Result: labels can't be deleted (they're page content); boxes fillable
Compliance attestation: copy-locked + flatten on return
An annual attestation employees sign off. Block copying outbound; flatten each signed return for the audit file.
Outbound PDF Permission Setter → owner pw, Block copying ON Inbound PDF Flatten → locks the attested values Audit copy: tamper-resistant static record
Edge cases and what actually happens
No form-fill-only permission in the tool
by designThe tool exposes only Block printing and Block copying and always sends --modify=all. There is no 'allow filling, block everything else' toggle. In practice modify-on is what keeps fields fillable; to lock everything else, flatten the returned form with PDF Flatten.
Blocking copy can also block field-value extraction
limited--extract=n disables text/graphics extraction in conformant viewers, which some form-processing tools rely on to read back submitted field values programmatically. If you process returns with software that extracts text, leave Block copying off on the outbound form.
Recipient can't save the filled form
limitedWhether Adobe Reader can save a completed form depends on the form having Reader Extension (usage) rights — a Reader-specific feature unrelated to permissions. This tool does not add Reader Extensions. If recipients can't save, they may need Acrobat or the form needs to be Reader-enabled by the author.
Owner password left empty
errorThe owner password is required; a blank field raises 'Enter an owner password.' before encryption runs.
Flattening the wrong file
expectedFlatten the RETURNED form (to lock answers), not the blank template — flattening a blank form removes the fillable fields entirely. Order matters in the workflow.
Form already encrypted
limitedqpdf can't re-encrypt a file it can't open. Unlock it first with PDF Unlock, then set permissions.
Corrupted form PDF
qpdf errorqpdf exits code 2 with 'qpdf could not process this PDF — it may be corrupted or use an unsupported encryption.' Repair with PDF Repair and retry.
Form over the tier limit
blockedFree tier caps at 2 MB / 50 pages. Multi-page application packets may exceed this — Pro raises it to 50 MB / 500 pages.
Frequently asked questions
Can I set a 'fill forms only' permission with this tool?
No. The Permission Setter exposes only Block printing and Block copying and always sends --modify=all. There is no form-fill-only toggle. The good news is that leaving modify enabled is exactly what keeps fields fillable; to lock everything else, flatten the returned form with PDF Flatten.
Will recipients still be able to fill the form after I set permissions?
Yes. Because modification is left at --modify=all, AcroForm fields remain fillable in Adobe Reader and other viewers. Setting an owner password and blocking print/copy does not disable the fields themselves.
How do I lock the answers once a form comes back?
Run PDF Flatten on the returned, completed form. It bakes each field's value into static page content so the answers can't be edited — ideal for archiving as a record.
Can I stop recipients from adding annotations?
There's no annotation toggle, and modify is left on, so a conformant viewer can still allow comments. To prevent annotations on the distributed file, flatten it first with PDF Flatten (though that also flattens fields). For most form workflows you flatten on return, not on send.
Should I block copying on the outbound form?
Only if you don't process returns with text-extraction tooling. --extract=n disables the extraction path that some form-reading software uses to pull back field values. If a human reads the returns, blocking copy is fine; if a script extracts values, leave it off.
Can recipients save the form they filled in?
That depends on Reader Extension rights in the form, not on permissions. Adobe Reader can save completed forms only when the document has those usage rights enabled by the author. This tool does not add Reader Extensions — if saving fails, the form needs to be Reader-enabled or opened in Acrobat.
Does setting an owner password stop people opening the form?
No. The owner password protects permissions; the open (user) password is left empty, so the form opens without a prompt. To require a login/password to open, use PDF Password Protect.
What encryption is applied to the form?
AES-256 (qpdf's 256-bit / R6). The permission dictionary is sealed in the encrypted structure, so the print/copy flags can't be flipped without the owner password.
Is the form data uploaded to your servers?
No. qpdf runs in your browser via WebAssembly. The form, owner password, and any data never leave your device. Only an anonymous usage counter is recorded when you're signed in — important for HR and compliance PII.
How do I keep recipients from deleting instruction labels?
Author the labels as ordinary page content rather than form fields, and keep only the answer boxes as AcroForm fields. Page content isn't editable through normal form interaction, so the labels survive while the boxes stay fillable.
Can I process a whole batch of returned forms at once?
The browser tool is single-file, so flatten each return individually, or pair the JAD runner to script flattening locally. There is no batch mode in the Permission Setter itself.
How do I remove the protection from a form later?
Use PDF Remove Password with the owner password you set to strip the AES-256 encryption and all permission flags.
Privacy first
All PDF processing runs locally in your browser using PDF-lib and pdf.js. No file is ever uploaded — only metadata counters are saved for signed-in dashboard stats.