Some PDF tools claim AES-256 encryption but generate their 256-bit keys from a very small state space or insecure random sources. This dramatically weakens the effective security, in one case reducing it to something like a 9-bit key. Users should not assume advertised AES-256 means strong protection without verified key generation.