Opening a protected PDF

1. What you received

A protected PDF, sent to you by someone you know.
It comes as one Windows file named after the document and ending in .exe, for example Contract.exe. It is a small program that opens the document in its own window.
There is nothing to install. The document never lands on your disk as a PDF: its pages are only shown on screen.

2. What you need

Windows 10 or 11.
An internet connection while you read. The pages are loaded securely from our server as you go.
Mac, Linux, phones and tablets are not supported. If you do not have a Windows computer, ask the sender for another way to access the document.

3. How to open it

Only do this if you know and trust the person who sent you the file. If you were not expecting it, check with the sender before you open it.

Download the file

Use the link the sender gave you, for example from Google Drive, OneDrive, Dropbox or WeTransfer.
If your browser warns you, choose Keep

Browsers warn about files that are not commonly downloaded. Every protected file is unique, so this is expected. Choose Keep, or the option to download the file anyway. In Microsoft Edge, click the three dots (...) next to the file, choose Keep, then Show more and Keep anyway.

Downloads

Contract.exe This file isn't commonly downloaded.

Delete Keep

Example only: your browser may look different.
Double-click the file

You will usually find it in your Downloads folder. If Windows shows Windows protected your PC, click More info, then Run anyway. Windows shows this for new apps it has not seen before.

Windows protected your PC
Windows prevented an unrecognized app from starting.
More info
Don't run

First, click More info.

Windows protected your PC
App: Contract.exe
Publisher: Unknown publisher

Run anyway Don't run

Then click Run anyway.
Sign in, if asked

Enter the username and password the sender gave you, then click Log in and open PDF. Some files open without signing in.

4. If it is blocked

On some computers Windows blocks the file and offers no Run anyway button, for example when Smart App Control is on, or when your company's IT policy does not allow new apps. An antivirus may also remove the file. In these cases the file cannot open on that computer. Ask the sender for another way to access the document. On a work computer, you can also share the notes below with your IT team.

5. For IT teams

Network: the reader connects over HTTPS (TCP port 443) to api.pdfbluesecurity.com. Allowing this domain is required, including through proxies and firewalls. The reader uses the Windows certificate store, so HTTPS inspection with a root certificate trusted by Windows works.
The file: each protected document is a unique .exe (the reader plus the encrypted document). It is not code-signed, so today it cannot be allowlisted by publisher or certificate. Policies that only allow signed apps will block it.
On the computer: it runs as the signed-in user, with no installation, and does not ask for administrator rights. While it runs, it unpacks its own runtime into the user's temporary folder. The reader never saves the document or its pages to disk.

6. Good to know

Screenshots and screen sharing usually don't show the document

That is on purpose. The reader hides its window from most screenshot, screen-recording and screen-sharing apps, so the document does not show.

Can I print it?

Only if the sender allowed printing, and only to a physical printer. Printing to PDF, XPS, OneNote, fax or a file is blocked. If the button says Print (preparing…), wait until the whole document has loaded.

Why is there a watermark?

Pages can show a watermark, such as your name, and a small tracking code. The sender uses them to discourage leaks.

It says a limit was reached

The sender can limit views, prints, devices and dates, and can end access at any time. When a limit is reached, the file tells you. Ask the sender if you need more access.

It says it can't connect

Check your internet connection. On a company network, a proxy or firewall may be blocking api.pdfbluesecurity.com: ask your IT team.

Can I rename the file?

Yes, but keep .exe at the end of the name, or Windows will not open it.

7. Privacy: what the reader sends

The reader connects to api.pdfbluesecurity.com over HTTPS and sends:

The encrypted document inside the file, so our server can prepare the pages you see.
An anonymous device ID, used for the sender's device limit and, if the sender chooses, shown in the watermark. It is a one-way hash of your computer's Windows machine ID (or of its network adapter ID if that is not available), never the real value.
Your username and password, only if the file asks you to sign in.
The reader's version, the number of copies when you print, and a short check about once a minute while the file is open, so the sender can end access.

Like any website, our server also sees your IP address. The reader does not send your own files, your Windows user name, your computer name or your list of printers.

In their access log, the sender can see when the file was opened and printed, from which IP address, with which username if you signed in, and the tracking code of each session. Read our Privacy Policy.

Questions about access, passwords or limits? Contact the person who sent you the file: only they can change them. For a technical problem, contact us.