Encryption

Protect PDFs with AES-256 encryption, control what users can do with permission flags, open and decrypt password-protected files, and remove restrictions from locked documents.

Encrypting a Document

Use Encrypt with an Encryption256Bit object to apply AES-256 encryption (the recommended standard for all new content):

PdfEditor.Open("report.pdf")
    .Encrypt(new Encryption256Bit
    {
        OwnerPassword = "admin-2026",
        UserPassword = "reader-2026"
    })
    .Save("report-encrypted.pdf");

Encrypt a Generated Document

Use PdfEditor.Create to generate and encrypt in a single chain:

PdfEditor.Create(doc =>
{
    doc.Page(page =>
    {
        page.Size(PageSizes.A4);
        page.Margin(50);
        page.Content().Column(col =>
        {
            col.Item().Text("Confidential Financial Data").FontSize(20).Bold();
            col.Item().PaddingTop(20).Text("Revenue: $4,821,000");
            col.Item().Text("Net Income: $1,203,000");
        });
    });
})
.SetTitle("Q1 Financial Summary")
.Encrypt(new Encryption256Bit
{
    OwnerPassword = "finance-admin",
    UserPassword = "finance-reader",
    AllowPrinting = false,
    AllowContentExtraction = false
})
.Save("q1-financials.pdf");

Owner Password vs User Password

Owner-Only Encryption (No Open Password)

PdfEditor.Open("manual.pdf")
    .Encrypt(new Encryption256Bit
    {
        OwnerPassword = "master-key-2026",
        // UserPassword is null — anyone can open
        AllowPrinting = true,
        AllowContentExtraction = false,
        AllowAnnotation = false
    })
    .Save("manual-protected.pdf");

Permission Flags

Permission flags control what operations are allowed when the document is opened with the user password. The owner password always grants full access regardless of these flags.

Encryption256Bit Properties

Common Permission Combinations

Read-Only Document

PdfEditor.Open("contract.pdf")
    .Encrypt(new Encryption256Bit
    {
        OwnerPassword = "legal-admin",
        UserPassword = "view-only",
        AllowPrinting = false,
        AllowContentExtraction = false,
        AllowAnnotation = false,
        AllowAssembly = false,
        AllowFillingForms = false
    })
    .Save("contract-locked.pdf");

Fillable Form with Printing

PdfEditor.Open("application-form.pdf")
    .Encrypt(new Encryption256Bit
    {
        OwnerPassword = "hr-admin-2026",
        AllowPrinting = true,
        AllowFillingForms = true,
        AllowContentExtraction = false,
        AllowAnnotation = false,
        AllowAssembly = false
    })
    .Save("application-form-protected.pdf");

Encryption Levels

FolioPDF supports three encryption levels. Use 256-bit AES for all new content unless you must support very old PDF readers:

128-Bit Encryption

PdfEditor.Open("document.pdf")
    .Encrypt(new Encryption128Bit
    {
        OwnerPassword = "admin",
        UserPassword = "reader",
        AllowPrinting = true,
        AllowContentExtraction = true
    })
    .Save("document-128bit.pdf");

40-Bit Encryption (Legacy)

PdfEditor.Open("legacy-document.pdf")
    .Encrypt(new Encryption40Bit
    {
        OwnerPassword = "admin",
        AllowPrinting = true,
        AllowContentExtraction = true,
        AllowModification = true,
        AllowAnnotation = true
    })
    .Save("legacy-encrypted.pdf");

Opening Encrypted Files

Pass the password to PdfEditor.Open to edit an encrypted document:

PdfEditor.Open("encrypted-report.pdf", password: "reader-2026")
    .SetTitle("Updated Title")
    .Save("encrypted-report-updated.pdf");

Opening from Bytes

byte[] encryptedBytes = File.ReadAllBytes("encrypted.pdf");

PdfEditor.Open(encryptedBytes, password: "my-secret")
    .AddBookmark("Summary", pageIndex: 0)
    .Save("encrypted-bookmarked.pdf");

Inspecting Encrypted Files

The PdfiumDocument inspection API also accepts a password:

using var doc = PdfiumDocument.Load(
    File.ReadAllBytes("protected.pdf"),
    password: "reader-password");

Console.WriteLine($"Pages: {doc.PageCount}");
Console.WriteLine($"Title: {doc.GetMetadata().Title}");

using var page = doc.GetPage(0);
string text = page.ExtractText();
Console.WriteLine($"First page text: {text[..100]}...");

Decrypting a Document

Remove all encryption from a document (you need the owner or user password to open it first):

PdfEditor.Open("encrypted-report.pdf", password: "admin-2026")
    .Decrypt()
    .Save("report-decrypted.pdf");

The output file has no encryption at all — no passwords, no restrictions.

Removing Restrictions

RemoveRestrictions() strips all security restrictions and decrypts the document. This is the "unlock everything" operation:

PdfEditor.Open("locked.pdf", password: "admin-password")
    .RemoveRestrictions()
    .Save("unlocked.pdf");

Re-Encrypting with Different Settings

Open an encrypted file, decrypt it, then re-encrypt with different passwords or permissions:

PdfEditor.Open("old-encrypted.pdf", password: "old-admin")
    .Decrypt()
    .Encrypt(new Encryption256Bit
    {
        OwnerPassword = "new-admin-2026",
        UserPassword = "new-reader-2026",
        AllowPrinting = true,
        AllowContentExtraction = false
    })
    .Save("re-encrypted.pdf");

Encryption with Linearization

Encryption and linearization can be combined. qpdf handles the correct internal ordering:

PdfEditor.Open("report.pdf")
    .SetTitle("Quarterly Report")
    .Encrypt(new Encryption256Bit
    {
        OwnerPassword = "admin-key",
        AllowPrinting = true,
        AllowContentExtraction = false
    })
    .Linearize()
    .Save("report-secure-web.pdf");

XMP Metadata Encryption

By default, EncryptMetadata is true — the XMP metadata stream is encrypted along with the rest of the document. Set it to false if you need document metadata to remain searchable in cleartext (e.g. for document management systems that index encrypted PDFs):

PdfEditor.Open("report.pdf")
    .Encrypt(new Encryption256Bit
    {
        OwnerPassword = "secure-key",
        EncryptMetadata = false  // metadata stays in cleartext
    })
    .Save("report-searchable-metadata.pdf");

Security Best Practices

Complete Example: Secure Document Pipeline

PdfEditor.Create(doc =>
{
    doc.Page(page =>
    {
        page.Size(PageSizes.A4);
        page.Margin(50);
        page.Content().Column(col =>
        {
            col.Item().Text("Merger & Acquisition Proposal").FontSize(24).Bold();
            col.Item().PaddingTop(15).Text(
                "This document contains material non-public information. " +
                "Distribution is restricted to authorised personnel only.");
            // ... detailed content ...
        });
    });
})
.SetTitle("M&A Proposal - Project Phoenix")
.SetAuthor("Corporate Development")
.StampText(new TextStamp("CONFIDENTIAL")
{
    FontSize = 60, Opacity = 0.12f, Rotation = -45,
    Color = Color.FromHex("#CC0000"), Bold = true
})
.Encrypt(new Encryption256Bit
{
    OwnerPassword = Environment.GetEnvironmentVariable("PDF_OWNER_KEY")!,
    UserPassword = "phoenix-2026",
    AllowPrinting = false,
    AllowContentExtraction = false,
    AllowAnnotation = false,
    AllowAssembly = false,
    AllowFillingForms = false
})
.Save("proposal-phoenix-secure.pdf");

Next Steps

• Digital Signing — PFX/X509 signatures and verification
• Compression — reduce file size before encrypting
• Metadata & Bookmarks — document properties and navigation