Encryption & Password Protection

TerraFluent.Pdf.Reporting encrypts documents with AES-256 using the PDF Standard Security Handler Revision 6 (ISO 32000-2 / PDF 2.0) by default — SHA-2 based key derivation with no MD5 or RC4 in the chain. Encrypted documents are opened by every major PDF viewer — Adobe Acrobat 9+ (2008), Chrome, Edge, Firefox, Preview, Foxit, Okular, and others.

For documents that must open in very old viewers, legacy AES-128 (Revision 4) remains available via Algorithm = EncryptionAlgorithm.Aes128.

No external packages are required. The entire implementation uses System.Security.Cryptography only.

Quick start

PdfDocument.Create(container =>
{
    container.Encrypt(new EncryptionOptions
    {
        UserPassword  = "open123",    // required to open the document
        OwnerPassword = "admin456",   // grants full access regardless of permissions
        Permissions   = PdfPermissions.Print | PdfPermissions.CopyText,
    });

    container.Page(page =>
    {
        page.Size(PageSize.A4);
        page.Margin(2, Unit.Centimetre);
        page.Content().Text("This PDF is password-protected.").Bold().FontSize(18);
    });
})
.PublishPdf("protected.pdf");

EncryptionOptions properties

PdfPermissions flags

Combine flags with the bitwise-OR operator:

PdfPermissions.Print | PdfPermissions.CopyText

Common patterns

View-only — no printing or copying

container.Encrypt(new EncryptionOptions
{
    UserPassword = "readonly",
    Permissions  = PdfPermissions.None,
});

Open without a password, but restrict printing

Leaving UserPassword empty means the viewer opens the document without prompting, while still enforcing the permission flags:

container.Encrypt(new EncryptionOptions
{
    OwnerPassword = "admin",
    Permissions   = PdfPermissions.None,   // viewer cannot print or copy
});

Owner password only — full restriction for all users

container.Encrypt(new EncryptionOptions
{
    UserPassword  = "userpass",
    OwnerPassword = "ownerpass",
    Permissions   = PdfPermissions.Print | PdfPermissions.ExtractForAccessibility,
});

Encrypt everything, allow all permissions

This encrypts content (making copy-paste from outside viewers harder) while allowing full interactive use inside the viewer:

container.Encrypt(new EncryptionOptions
{
    UserPassword = "open",
    Permissions  = PdfPermissions.All,
});

Technical details

AES-256 — Revision 6 (default)

AES-128 — Revision 4 (legacy opt-in)

Note on MD5/RC4: used exclusively in the Revision 4 key-derivation steps mandated by the PDF specification — never for content encryption, and not at all in the Revision 6 default.

What gets encrypted

• Content streams — the PDF drawing operators for every page
• Image XObjects — PNG and JPEG pixel data (and alpha soft masks)
• Strings — document metadata, bookmark titles, hyperlink URIs

What is NOT encrypted (per PDF specification)

• The /Encrypt dictionary itself (§7.6.1)
• Cross-reference tables and trailer
• Stream lengths
• The %PDF- header

Zero-dependency

The implementation uses only System.Security.Cryptography (Aes, SHA256/SHA384/SHA512, MD5 for Rev 4 only, and RandomNumberGenerator).

Calling Encrypt in your document

Call container.Encrypt(options) once inside the PdfDocument.Create callback. It may be called before or after adding pages; the encryption is applied when PublishPdf() is called. Calling Encrypt a second time replaces the previous settings.

PdfDocument.Create(container =>
{
    // Encryption must be configured before PublishPdf() is called.
    // Position relative to Page() calls does not matter.
    container.Encrypt(new EncryptionOptions { UserPassword = "secret" });

    container.MetadataTitle("Confidential Report");

    container.Page(page => { /* … */ });
    container.Page(page => { /* … */ });
})
.PublishPdf("report.pdf");

View this page's source on GitHub →