Encryption · C# and .NET
Encrypt a PDF in C#
Password-protect a PDF from C# with AES-256 encryption. rust-pdf applies standard-handler encryption at output, deriving keys and IVs from the operating system CSPRNG, and supports user and owner passwords plus permission flags.
Last updated: 2026-06-29
Why C# and .NET needs this
Run dotnet add package RustPdf and the NuGet package carries the native core next to your managed assemblies. A NativeLibrary.SetDllImportResolver hook locates it under runtimes/<rid>/native, the build output, or a RUSTPDF_LIB override, so an ASP.NET Core app loads it with no MSBuild wiring or native toolchain on the developer machine.
Encryption touches the payloads you least want leaking (statements, medical records, signed contracts), so it belongs in a request pipeline that disposes deterministically. EditableDoc.LoadFile wraps an IDisposable native handle; a using block frees the document the instant the response is written, even when the endpoint throws. AES-256 (V5/R6) draws its key, salts and IVs from the OS CSPRNG, with AES-128 and legacy RC4 also available.
The same call deploys unchanged to a mcr.microsoft.com/dotnet/aspnet:8.0 container, a dotnet publish --self-contained bundle, or a Worker Service. P/Invoke is source-generated with [LibraryImport], so it is trim- and NativeAOT-friendly as long as the matching runtimes/<rid>/native payload travels with the publish output; a missing Encryption license surfaces as a catchable PdfException.
- AES-256 (V5/R6) with keys and IVs from the OS CSPRNG, plus AES-128 and RC4 for legacy needs.
- Separate user and owner passwords, with a read-only permission mode.
- Encrypt new documents or an existing PDF you load and re-save.
Encrypt a PDF in C# with rust-pdf
Install with NuGet, then call the same idiomatic API every rust-pdf binding shares. The snippet below is real C# code from the reference docs.
dotnet add package RustPdf
using RustPdf;
using var ed = EditableDoc.LoadFile("in.pdf");
ed.Encrypt(user: "", owner: "owner-secret",
method: Encryption.Aes256, readOnly: true);
ed.Save("secured.pdf"); // throws PdfException without an Encryption licenseC# basic generation is free. Encryption is a corporate feature, unlocked by one offline license token. See pricing & licensing.
Full C# reference in the documentation.
Encryption in C#: FAQ
How strong is the encryption?
rust-pdf uses AES-256 with the modern V5/R6 security handler, the strongest standard PDF encryption. Keys, salts and IVs come from the operating system CSPRNG, so every encrypted file is unique. qpdf validates the output for both user and owner passwords.
What is the difference between user and owner passwords?
A user password is required to open the document. An owner password leaves the file openable but restricts actions such as printing or copying. You can set either or both, and enable a read-only permission mode.
Do I need a license to encrypt in C#?
Encryption is a corporate feature and needs an active license token. Basic generation in C# is free. The same offline token enables encryption in every language.
Does this work with ASP.NET Core and NativeAOT?
Yes. The binding reaches the native core through source-generated [LibraryImport] P/Invoke, which is trim- and NativeAOT-safe, and a NativeLibrary.SetDllImportResolver hook finds the library inside the published runtimes/<rid>/native folder. Encrypt from a minimal-API handler or controller and dispose the EditableDoc with a using block so the native handle is released on every request.
Ship password-protected PDFs from your .NET stack
One Rust core, the same output across every language. Prototype for free, license the corporate features when you ship.