Encrypt / re-secure a PDF
encrypt_pdfEncrypt a PDF with AES-128 or AES-256 security. Set owner and optional user passwords, and configure permissions. Also supports password rotation for already encrypted files.
Instructions
Re-secure an existing PDF with the PDF Standard Security Handler (pdfnative v1.6.0): AES-128 (V4/R4, default) or AES-256 (V5/R6). RC4 is never emitted. Set ownerPassword (required) and optionally userPassword (open password), algorithm, and permissions { print, copy, modify, extractText }. Re-encrypt an already-encrypted source under a NEW password by passing its current password (password rotation in one call). CAVEAT: encryption rebuilds the page tree, so existing signatures and the interactive AcroForm are DROPPED and only self-contained URI links are kept — encrypt BEFORE signing, not after.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| password | No | Current password of an already-encrypted source (enables password rotation). Omit for an unencrypted source. | |
| algorithm | No | Content cipher: aes128 (V4/R4, widest compatibility) or aes256 (V5/R6, strongest). | aes128 |
| pdfBase64 | Yes | Base64-encoded source PDF to encrypt. NOTE: existing signatures and AcroForm are dropped (page-tree rebuild). | |
| outputMode | No | base64 | |
| outputPath | No | Required when outputMode='file'. Relative path inside the sandbox; must end with .pdf. | |
| permissions | No | Access permission flags (enforced by conforming readers). Each defaults to allowed when omitted. | |
| userPassword | No | User (open) password. Omitted or empty string means the document opens without a password prompt. | |
| ownerPassword | Yes | Owner password (required, non-empty). Controls permissions and full access. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | ||
| filePath | No | Absolute sandboxed file path (when mode='file'). | |
| sizeBytes | Yes |