Encrypt

Encrypt

Password-protect a PDF with user and/or owner password. Default: AES-256 (PDF 2.0 files must use AES-256).

• user password (--upw) — needed to open the document
• owner password (--opw) — needed to change permissions; also authenticates for full access

Command line

pdfcpu2 encrypt [--mode rc4|aes] [--key 40|128|256] [--perm none|print|all] inFile [outFile]

pdfcpu2 encrypt --opw owner --upw user in.pdf out.pdf        # AES-256
pdfcpu2 encrypt -m rc4 -k 128 --opw owner in.pdf out.pdf     # legacy RC4-128
pdfcpu2 encrypt --opw "$OPW" - - < in.pdf > out.pdf          # pipeline

Permissions at encryption time via --perm: none (default), print, all — or an explicit bit pattern, see Permissions.

Password files for CI/secrets:

pdfcpu2 encrypt --opw-file /run/secrets/opw --upw-file /run/secrets/upw in.pdf out.pdf

Go API

package main

import (
	"context"

	"github.com/huzpsb/pdfcpu2/pkg/api"
	"github.com/huzpsb/pdfcpu2/pkg/pdfcpu/model"
)

func main() {
	ctx := context.Background()
	conf := model.NewDefaultConfiguration()

	conf.OwnerPW = "owner"
	conf.UserPW = "user"
	conf.EncryptUsingAES = true
	conf.EncryptKeyLength = 256
	// conf.Permissions: see model.PermissionFlags and [[Permissions]]

	err := api.EncryptFile(ctx, "in.pdf", "out.pdf", conf)
	if err != nil {
		panic(err)
	}
}

Related: Decrypt, Change Password, Permissions.