Report Password Protection

Why Pentest Reports Need Encryption

Penetration test reports contain some of the most sensitive information in an organization's security program. They document exactly how to exploit the organization's systems - complete with proof-of-concept payloads, internal network details, and attack chains. If a report falls into the wrong hands, it becomes a roadmap for attackers.

TurboPentest lets you set a report password on your account. Once set, every PDF report you download is encrypted with AES-256 PDF encryption before it leaves the server. Anyone who obtains the file - through a forwarded email, a shared drive, or an intercepted download - cannot open it without the password.

The Encryption Stack

AES-256 PDF Encryption

When a report password is set, TurboPentest applies standard PDF encryption with a 256-bit AES key (via the qpdf encryption engine) to the generated PDF:

• User password - Your report password, required to open the document in any standard PDF reader
• Owner password - A randomly generated 256-bit value, never disclosed, which prevents permission changes
• Permissions - Printing remains allowed so recipients can work with the report normally

The "256" in AES-256 refers to the key length in bits. A 256-bit key has 2^256 possible values - a number so large that brute-force attacks against the key itself are computationally infeasible with any current or foreseeable technology. AES-256 is approved by NIST and used by governments worldwide for classified information.

Because this is standard PDF encryption, no special software is needed: Adobe Acrobat, Preview, browser PDF viewers, and other mainstream readers all prompt for the password and refuse to open the document without it. Entering the wrong password produces a clear "incorrect password" error rather than garbled output.

Protecting the Stored Password: AES-256-GCM

Applying encryption at download time means TurboPentest must keep your report password available to the encryption pipeline. The password is never stored in plaintext. Instead, it is encrypted with AES-256-GCM (Galois/Counter Mode) under a server-side key that lives only in the application environment, separate from the database.

AES-256-GCM is an authenticated encryption scheme, which means it provides both confidentiality and integrity:

• Confidentiality - The stored password is unreadable without the server-side key
• Integrity - Any tampering with the encrypted value is detected upon decryption
• Authentication - The GCM authentication tag proves the ciphertext has not been modified

Each encryption operation uses a fresh random initialization vector (IV). The IV must be unique for every encryption operation with the same key: reusing an IV with the same key in GCM mode completely breaks the security guarantees, allowing plaintext recovery and authentication tag forgery. TurboPentest generates the IV from a cryptographically secure random number generator, and stores the IV, ciphertext, and authentication tag together.

A database compromise alone therefore does not expose report passwords - the attacker would also need the server-side key from the application environment.

The Download Flow

When you download a PDF report and a report password is set:

1. The report PDF is generated (or fetched from the cache)
2. The stored report password is decrypted server-side with AES-256-GCM
3. The PDF is encrypted with AES-256 PDF encryption using your password as the user password and a random owner password
4. The encrypted PDF is streamed to your browser; the unprotected version is never delivered

Recipients open the file in any PDF reader and enter the password you share with them through a separate channel.

Setting and Managing the Password

The report password is configured in your account's security settings and applies to all report downloads on the account. To resist guessing and cracking attacks, passwords must meet strength requirements:

• At least 12 characters
• At least one uppercase letter
• At least one lowercase letter
• At least one number
• At least one special character

You can change the password or remove it at any time. Because encryption is applied at download time, changing the password simply means future downloads use the new password - and if you forget it, you can set a new one and re-download the report.

When sharing a protected report, deliver the password through a different channel than the report itself (for example, the PDF by email and the password by phone or chat), so compromising a single channel does not expose the report contents.

Compliance Considerations

AES-256 encryption for report files and AES-256-GCM protection for stored secrets are built to meet the encryption requirements of frameworks such as SOC 2 Type II, ISO 27001, HIPAA, and PCI DSS. For organizations subject to these frameworks, TurboPentest's report password protection provides documentation-ready evidence of data protection controls applied to sensitive security assessment output.