Most "protect PDF" dialogs give you two password boxes and very little explanation. Here is what each one actually does.

The open (user) password. With this set, the file is encrypted and nobody can read its contents without the password. This is the one that gives you real confidentiality.

The owner (permissions) password. This lets anyone open the file, but tells the reader app to block printing, copying text, editing, filling forms or reorganising pages. Adobe Reader, Chrome, Edge and most mobile viewers respect these flags. But they are flags: a reader that ignores them, or a tool that rewrites the file, can drop them. Treat permissions as "please don't" signs for honest users, not as a lock.

Which encryption? PDF has used RC4-40, RC4-128, AES-128 and AES-256 over the years. Use AES-256 (PDF 2.0 / Acrobat X style) unless you must support a very old reader; then AES-128.

Practical rules

  • Confidential file: set an open password, 12+ characters, AES-256.
  • Shareable but not editable (e.g. a handout): owner password only, block editing and copying, allow printing.
  • Send the password through a different channel from the file.
  • Keep an unprotected original somewhere safe; a forgotten AES-256 open password cannot be recovered.

If you want to do it from code, qpdf does both in one line:
qpdf --encrypt OPENPASS OWNERPASS 256 --print=none --modify=none -- in.pdf out.pdf

Disclosure: I run GoToolsOnline. Its free PDF Password Protect tool does the same in the browser (separate open and owner passwords, restrictions, AES-256, up to 20 files at once returned as a ZIP): https://gotoolsonline.com/tools/pdf-password-protect