Protect PDF

PDF encryption works at the file level. When you protect a PDF, the file's content streams (text, images, fonts) are wrapped in an AES-256 encryption layer keyed off your password. Without the password, a viewer can see that the file is a PDF and read its metadata, but the actual content is unreadable cipher text. With the password, the viewer derives a decryption key, unlocks the streams on the fly, and displays the document normally.

SwitchPDF uses pdf-lib's encryption pipeline which implements PDF 2.0's AES-256 standard — the strongest encryption available in the PDF spec. Cracking a 12-character random password by brute force would take longer than the age of the universe with current computing power. The protection is real, not just a "click here to enter password" prompt that any tool can ignore.

The two restriction flags are part of a separate "permissions" layer. When set, they tell compliant PDF viewers to disable the Print button and disable text selection / copy. Adobe Reader, Preview, Chrome, and other major viewers all respect these flags. Some advanced PDF tools can still extract the content if they have the password — restrictions are a UX guard, not a hard security barrier.

Common scenarios: emailing a contract draft that should not be forwarded; sending an invoice to a customer over an untrusted channel; archiving sensitive HR or financial records; sharing pre-publication creative work. For the strongest protection, use a long random password (12+ characters), share it through a separate channel from the file itself, and rotate it for each new recipient.