← All posts

Locking a filled-in PDF form so the answers can’t be changed

The form is filled in. The figures are right, the boxes are ticked, and now it has to go to someone — a client, a regulator, head office — as a record rather than as a form. What you want is simple to say: they should be able to read it, and they should not be able to change it.

Search for that and you get three kinds of answer. A tool page telling you to click "lock". A document security company explaining that only their DRM can really stop anyone. And five forum threads where somebody asked exactly your question and got told to print it to PDF.

None of them tells you what "locked" means to a PDF, and that is the only thing worth knowing here, because a PDF has three separate mechanisms that all get called locking and only two of them do anything.

The three things people mean by "lock"

A flag that asks the reader to behave. A form field can carry a read-only bit, and a document can carry permission flags saying printing is allowed and editing is not. Both are just values stored inside the file. Your reader looks at them and declines to let you type. Another program looks at them and does whatever it likes, because nothing enforces them — there is no key, no cryptography, nothing to break. Clearing a read-only bit is a one-line change in any PDF library.

Removing the mechanism entirely. The answers stop being a form and become part of the printed page. There is no field left to type into, in any software, because there is no field. This is flattening, and for the job you are describing it is the right answer.

Encryption. The bytes are genuinely scrambled and a password is needed to get at them. This is real security, but it answers a different question: it controls who can open the document, not what they can do once it is open.

The DRM pitch you found is a fourth thing — a viewer application that will not let you save, print or screenshot, sold as a service. It works by refusing to hand the recipient a PDF at all. If what you need is to email somebody a file, it is not in the running.

Why flattening is the one that holds

To see why removing the field beats flagging it, you need one fact about where your answers live: they are not on the page. Each one sits in a form field, an object held at document level that your reader draws on top of the page when the file opens — which is why deleting a field takes the answer with it.

That is why the flags are weak. The value is sitting in a field, plainly marked as a field, waiting for something to change it. A read-only bit is a note pinned to it saying please don't.

Flattening removes the reason to trust anybody. It paints each answer onto the page at the exact rectangle it occupied and destroys the field behind it. Afterwards there is no AcroForm entry, no value, no editable object — just glyphs on a page, indistinguishable from the printed text of the form itself. Your reader will not offer to fill it in, because as far as the file is concerned there is nothing to fill in. That is the difference between a lock and a deletion, and it is why this is the operation that survives being opened in software you have never heard of.

Doing it

  1. Save the completed form to disk, then reopen it and check the answers are still there. This is not a formality. A browser viewer can show you answers that were never written into the file, and flattening one of those hands you back a blank form — why that happens.
  2. Put that saved file through Flatten PDF. Flatten form fields is on by default and is the whole job.
  3. Decide about the comments. Flatten comments and stamps starts off, because the usual case is freezing the answers while leaving review notes live. Tick it when the notes are part of the record. Links are left working either way — a flattened link would be an inert rectangle that still looks clickable.
  4. Read the run notes. They count what became page content. "12 form fields are now part of the page" means it worked. Zero means the file had no fields, and you were looking at something else.
  5. Test the result like a sceptic. Click where a box was: no cursor, no outline. Press Tab: the focus should not hop from answer to answer. Drag across an answer: it should select like ordinary text, because that is now what it is. For a second opinion, drop the file into our PDF inspector, which counts the form fields in your browser without uploading anything. A flattened file reports none.

Adding a password, and what it actually buys

If the record also should not be read by just anyone, encrypt it after flattening. Password protect PDF sets an opening password with AES, and separately sets the permission flags for printing, copying, editing and commenting. Flatten first, then protect: the order matters because we cannot flatten a file that is already encrypted, and you would have to take the password off again.

Be precise about which half you are relying on. The opening password is genuine — without it there is nothing to read. The flags are not.

What flattening will not stop

Someone painting over it. Flattened answers are ordinary page content, and page content can be edited. A determined person can open the file in an editor, cover a figure with a white box and type a new one. What stops them being subtle about it is that the file only embeds the glyphs it actually used, so the font changes when you edit text in a PDF and the replacement rarely matches. Our own PDF editor hits the same wall. Flattening makes a record tamper-evident to anyone who looks closely. It does not make it tamper-proof.

Getting your form back. There is no unflatten, in our tool or anybody else's: what you typed is page content now rather than a value waiting to be edited. Spot a typo afterwards and you correct the original and flatten it again, which is why filing the editable copy is a step and not a footnote.

Clearing the answers to reuse the form. That is the opposite operation, and it belongs to Remove annotations from PDF in its form fields mode. Reach for it after flattening, not before, and only when you meant it — deleting the fields deletes what was typed in, which is the single most common way this job goes wrong.

Dynamic XFA forms. We refuse these outright, and say why, instead of returning something plausible-looking and wrong. What they are, and how to get a flat copy of one, takes a couple of minutes in Adobe Reader.

If the record has to be provable, sign it

Flattening freezes the answers. It cannot tell a recipient in six months whether the copy in their inbox is the copy you sent. Only a certificate-based digital signature does that: it hashes the file's bytes and seals the hash, so any later change makes the reader show a warning.

The order is not negotiable. Flatten first, sign second. Sign a form and then flatten it and you will destroy the signature, for reasons that are worth understanding before you try it — flattening rewrites every byte in the file, and a signature is a promise about exactly those bytes. Our flatten tool warns you when the document was signed, but by then the useful moment has passed.

We do not sign documents. For that, free options exist and they are good ones: LibreOffice Draw will apply a certificate-based signature to an existing PDF, and Adobe Acrobat Reader will do it with a self-signed or issued credential. To check one, pdfsig file.pdf from poppler-utils prints the signer, the time and whether the signature still covers the whole document.

Doing the flattening without a browser

If the form contains anything you would rather not upload, or you do this weekly, it is one line locally and both of these are free:

You will also be told to print to PDF, and it does produce an unchangeable-looking file. Understand the trade before you take that advice: printing re-renders the whole document, so bookmarks and links go, the text may or may not survive as text depending on the printer driver, and the file is usually larger. It is fine for a one-page form nobody will ever search. It is the wrong tool for a fifty-page record.

The step people skip

Before you send the flattened copy, put the editable original somewhere you will find it again, with a name that says what it is. The flattened file is the record. The original is the only way to ever produce a corrected one.

Tools this post uses: