How to Password Protect a PDF — Encryption, Permissions, and Ownership Explained

import { PDFDocument, EncryptionAlgorithm } from 'pdf-lib';
import fs from 'fs';
 
async function protectPdf(inputPath, outputPath, options) {
  const {
    userPassword = '',          // Empty = no password required to open
    ownerPassword,              // Required to change permissions
    permissions = {
      printing: 'highResolution',   // 'highResolution', 'lowResolution', false
      modifying: false,
      copying: false,
      annotating: true,
      fillingForms: true,
      contentAccessibility: true,
      documentAssembly: false,
    },
    encryptionAlgorithm = EncryptionAlgorithm.AES_256,
  } = options;
 
  const pdfBytes = fs.readFileSync(inputPath);
  const pdfDoc = await PDFDocument.load(pdfBytes);
 
  const encrypted = await pdfDoc.encrypt({
    userPassword,
    ownerPassword,
    permissions,
    encryptionAlgorithm,
  });
 
  fs.writeFileSync(outputPath, await pdfDoc.save());
  console.log(`Protected PDF saved to ${outputPath}`);
}
 
// Password protect with AES-256, allow printing but deny copying/editing
await protectPdf('document.pdf', 'protected.pdf', {
  userPassword: 'ViewOnly123!',
  ownerPassword: 'AdminSecret456!',
  permissions: {
    printing: 'highResolution',
    modifying: false,
    copying: false,
    annotating: false,
    fillingForms: false,
    contentAccessibility: true,
    documentAssembly: false,
  },
  encryptionAlgorithm: EncryptionAlgorithm.AES_256,
});

from pypdf import PdfReader, PdfWriter
 
def protect_pdf(
    input_path: str,
    output_path: str,
    user_password: str = '',
    owner_password: str = '',
    allow_print: bool = True,
    allow_copy: bool = False,
    allow_modify: bool = False,
):
    reader = PdfReader(input_path)
    writer = PdfWriter()
    
    for page in reader.pages:
        writer.add_page(page)
    
    # Build permissions flags (PDF spec §7.6.4.2)
    permissions = 0
    if allow_print:  permissions |= (1 << 2)  # bit 3: print
    if allow_modify: permissions |= (1 << 3)  # bit 4: modify
    if allow_copy:   permissions |= (1 << 4)  # bit 5: copy
    
    writer.encrypt(
        user_password=user_password,
        owner_password=owner_password or user_password + '_owner',
        use_128bit=True,  # AES-128; for AES-256 use pypdf >= 3.x with algorithm param
    )
    
    with open(output_path, 'wb') as f:
        writer.write(f)
 
protect_pdf('input.pdf', 'protected.pdf',
            user_password='ViewOnly123!',
            owner_password='AdminSecret456!',
            allow_print=True,
            allow_copy=False)

# Password protect with owner and user passwords
gs -dBATCH -dNOPAUSE -dSAFER \
   -sDEVICE=pdfwrite \
   -dEncryptionR=4 \
   -dKeyLength=128 \
   -sOwnerPassword='AdminSecret456!' \
   -sUserPassword='ViewOnly123!' \
   -dPermissions=-3904 \
   -sOutputFile=protected.pdf \
   input.pdf
 
# -dPermissions is a bitmask. -3904 = allow printing, deny all else.
# Common permission values:
# -4 = deny all
# -3904 = allow printing only
# -60 = allow printing, copying, and annotations