Create Secure Document Workflows with PDF Password Protection

Share this page

PDF security involves two related but different controls: encryption that requires a password to open the file, and permissions that limit what an authorized viewer can do after opening it. The pdfRest Encrypt PDF and Restrict PDF API Tools let applications manage both controls as part of an automated document lifecycle.

Encrypt a PDF with an Open Password

Encrypt PDF applies AES 256-bit encryption and an open password to the document. A viewer must supply that password before accessing the PDF's contents. Applications can use the /encrypted-pdf endpoint to add or change an open password and the /decrypted-pdf endpoint to remove encryption when the caller supplies the current credentials.

This is appropriate for files that should remain unreadable without authorization, including confidential reports, customer documents, contracts, and archives. Passwords should come from a secure secret-management system rather than being embedded in application code or logs.

Encrypt Code Example | Load this into API Lab↗

curl -X POST "https://api.pdfrest.com/encrypted-pdf" \
-H "Accept: application/json" \
-H "Content-Type: multipart/form-data" \
-H "Api-Key: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" \
-F "file=@PATH_TO_FILE/pdfrest.pdf" \
-F "output=pdfrest_encrypted" \
-F "new_open_password=gy$djKDnc28&7khDH!" \

Restrict Printing, Copying, and Editing

Restrict PDF uses a permissions password and the restrictions[] parameter to control actions inside the document. Available restrictions cover high- or low-resolution printing, document assembly, form filling and signing, annotations, content editing, copying, and accessibility features. The current options support 256 possible combinations.

The /restricted-pdf endpoint can add or modify restrictions, while /unrestricted-pdf removes them when the correct permissions password is provided. A permissions password is not the same as an open password: it protects security settings and controls permitted actions, but it does not by itself require a password merely to view the file.

Restrict Code Example | Load this into API Lab↗

curl -X POST "https://api.pdfrest.com/restricted-pdf" \
-H "Accept: application/json" \
-H "Content-Type: multipart/form-data" \
-H "Api-Key: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" \
-F "file=@PATH_TO_FILE/pdfrest_encrypted.pdf" \
-F "output=pdfrest_encrypted_restricted" \
-F "new_permissions_password=lcl?bvdUG9895%dh#4" \
-F "restrictions[]=edit_annotations" \
-F "restrictions[]=edit_content" \
-F "restrictions[]=copy_content" \
-F "current_open_password=gy$djKDnc28&7khDH!" \

Combine Encryption and Restrictions Safely

Applications can use both controls on the same PDF. For example, an internal workflow can decrypt an authorized working copy, remove restrictions needed for editing, process the document, then reapply the required restrictions and open-password encryption before storage or delivery.

When changing restrictions on a PDF that already has an open password, provide the current_open_password parameter when required so that the encryption is retained. Otherwise, modifying the permissions settings may remove or replace existing security information. The current permissions password is likewise required to remove or change restrictions that are already present.

Decrypt Code Example | Load this into API Lab↗

curl -X POST "https://api.pdfrest.com/decrypted-pdf" \
-H "Accept: application/json" \
-H "Content-Type: multipart/form-data" \
-H "Api-Key: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" \
-F "file=@PATH_TO_FILE/pdfrest_encrypted_restricted.pdf" \
-F "output=pdfrest_decrypted_restricted" \
-F "current_open_password=gy$djKDnc28&7khDH!" \
-F "current_permissions_password=lcl?bvdUG9895%dh#4" \

Unrestrict Code Example | Load this into API Lab↗

curl -X POST "https://api.pdfrest.com/unrestricted-pdf" \
-H "Accept: application/json" \
-H "Content-Type: multipart/form-data" \
-H "Api-Key: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" \
-F "file=@PATH_TO_FILE/pdfrest_decrypted_restricted.pdf" \
-F "output=pdfRest_decrypted_unrestricted" \
-F "current_permissions_password=lcl?bvdUG9895%dh#4" \

Treat PDF Passwords as One Layer of Security

Encryption and permissions help protect individual files, but a secure workflow also needs access control, encrypted transport and storage, appropriate file retention, credential rotation, and audit logging. Applications should avoid exposing passwords in URLs, source repositories, analytics, or error messages.

It is also important to choose restrictions that match the business purpose. For example, disabling form filling or accessibility can make a document unusable for its intended recipient. Test the final PDF in the viewers and downstream systems used by the audience rather than assuming that every restriction is appropriate.

Use the Encrypt PDF API reference and Restrict PDF API reference for current parameters, endpoint behavior, and response examples.

Encrypt PDF

Restrict PDF