How We Encrypt and Restrict PDFs Entirely in the Browser

A practical look at AES encryption, PDF permission bits, PyMuPDF, Pyodide, and transferable worker buffers.

July 29, 20264 min read

An open password cryptographically controls access to a PDF. An owner password enables encryption and encodes viewer permission flags for printing, copying, editing, annotation, forms, assembly, and accessibility.

Those permission flags are not DRM: standards-compliant readers generally honor them, but specialized software may ignore them. The file and both passwords stay inside a Pyodide Web Worker.

Permission mapping

const PDF_PERM_PRINT = 4;
const PDF_PERM_COPY = 16;
const PDF_PERM_ASSEMBLE = 1024;

Disabling printing also disables high-quality printing. Protecting a signed PDF changes its bytes and ordinarily invalidates the signature.

Why would you want to do this?

Files often need to move between formats, people, and systems. This task helps you create a result that is easier to edit, share, submit, or archive. Common reasons include:

Avoid uploading confidential source documents.
Apply AES encryption with an established PDF engine.
Keep passwords out of network requests, logs, and analytics.

How to do it step by step

1
Transfer the PDF ArrayBuffer to a dedicated worker.
2
Load the same-origin Pyodide runtime and vendored PyMuPDF wheel.
3
Open and authenticate an already encrypted source when necessary.
4
Map UI choices to PDF permission bits and save with AES-256.
5
Return a Blob and create the download URL locally.

Which tools can you use?

Desktop software can work, but it may require an installation, paid plan, or account. A browser tool is more convenient for a quick task. Easy File Tools keeps the workflow direct: open the tool, choose your file, make the change, and download the result. Everything happens locally in your browser and nothing is uploaded.

The easy option: Easy File Tools

No account, no complicated setup, and a consistent interface across useful file tools.

Use Protect PDF free

Tips for a better result

Generate an independent owner password with crypto.getRandomValues.
Terminate workers to release WASM memory.
Verify encryption and permissions with an independent PDF reader.

Common mistakes to avoid

Describing viewer permission flags as unbreakable DRM.
Logging a password in an error or analytics event.
Silently falling back to a server when the worker fails.

How this compares to Smallpdf, iLovePDF and Adobe

A server implementation needs an upload, temporary files, and password handling. Pyodide runs the mature PyMuPDF engine within the browser sandbox and returns the encrypted bytes directly.

Comparison of Easy File Tools with Smallpdf, iLovePDF, and Adobe Acrobat online
Criterion	Smallpdf	iLovePDF	Adobe Acrobat online	Easy File Tools
Where your file is processed	Uploaded to their servers	Uploaded to their servers	Uploaded to Adobe's cloud	In your browser, so the file never leaves your device
Account or sign-in	Prompted quickly, and required to continue past the free allowance	Optional for small jobs, required for larger ones	An Adobe ID is needed for most online tools	Never required
Usage limits	A small number of free tasks before an upgrade prompt	Daily task and file-count limits on the free tier	Free web tools act as a preview of a paid plan	No task counters and no daily caps
File size ceiling	Free tier caps the upload size	Free tier caps the upload size	Cloud upload limits apply	Up to 100 MB on the tools that set a limit, with no paid tier needed to reach it
Works without a connection	No, the server does the work	No, the server does the work	No, the cloud does the work	Yes for browser-based tools, once the page has loaded
Cost	Paid subscription for full access	Paid subscription for full access	Paid Acrobat subscription for full access	Free, with every tool available to everyone

Third-party plans and limits change often, so this table describes the general shape of each offer rather than exact prices. Check each provider for current terms.

Frequently asked questions

Are permission restrictions DRM?

No. Encryption protects the open password, while permissions are controls that conforming viewers enforce.

Are files or passwords uploaded?

No. Bytes and passwords are transferred only to an in-browser worker.