Documentation

Working with encrypted PDFs

Open password-protected PDFs with RC4 40/128, AES-128 and AES-256 support, and handle ErrPasswordRequired cleanly.

Encrypted documents are decrypted transparently on open when they use the empty user password. Supply a user or owner password explicitly with OpenWithPassword, or through Options.Password on the context-taking entry points. A file that needs a password is reported with ErrPasswordRequired rather than producing a broken result.

The standard security handler is supported end to end: RC4 40-bit and 128-bit, AES-128, and AES-256.

encrypted.go

// Encrypted documents are decrypted transparently on open when they use
// the empty user password. Supply a user or owner password explicitly:
doc, err := gopdfrab.OpenWithPassword(path, []byte("secret"))
if errors.Is(err, gopdfrab.ErrPasswordRequired) {
	log.Fatal("a correct password is required to open this file")
}
defer doc.Close()

// Verify and Convert decrypt the same way, via Options.Password
res, err := gopdfrab.VerifyContext(ctx, path, gopdfrab.PDFA1B, gopdfrab.Options{
	Password: []byte("secret"),
})

PDF/A does not permit encryption

An archival document has to stay readable without a key, so an encrypted file can never itself be valid PDF/A. Decryption exists so you can read and convert such a file — the conversion output is written unencrypted.

That distinction matters in practice: verifying an encrypted PDF will always report an encryption issue, no matter how well-formed the rest of the document is. Converting it removes the encryption along with the other disallowed constructs.