Applies to: All editions
Encrypted or password-protected PDFs
PDFSanitize detects encryption during structural inspection. An encrypted or password-protected file is marked with a critical finding and cannot currently be sanitized.
During a batch sanitization, an analyzed encrypted PDF is skipped and its row is marked Encrypted – skipped. Other eligible selected documents can continue processing.
If sanitization is authorized, create an unencrypted working copy through the document owner’s approved process and analyze that copy as a new input.
Do not bypass access controls without authorization
PDFSanitize is not intended to defeat PDF passwords or encryption. Decryption should occur only when the operator has the necessary authorization, credentials, and retention basis.
Digitally signed PDFs
Analysis detects PDF digital-signature structures and records a finding explaining that sanitization will invalidate the existing signature.
Before sanitization begins, PDFSanitize displays a warning when one or more selected PDFs are digitally signed. The default safe choice is not to continue until the operator has confirmed that creating a modified derivative is permitted.
Preserve the signed original when required
When the original signature is evidence of authenticity, approval, or chain of custody:
- Retain the original signed PDF unchanged;
- Record its SHA-256 fingerprint where appropriate;
- Create the sanitized PDF as a separate disclosure copy;
- Do not describe the sanitized copy as retaining the original signature validity;
- Keep the relationship between original and sanitized output clear in the case or document-management record.
Maximum Assurance removes dependence on original page-level structures and therefore also cannot preserve the original PDF signature.