Encryption · Go
Encrypt a PDF in Go
Password-protect a PDF from Go with AES-256 encryption. rust-pdf applies standard-handler encryption at output, deriving keys and IVs from the operating system CSPRNG, and supports user and owner passwords plus permission flags.
Last updated: 2026-06-29
Why Go needs this
Sensitive PDFs (statements, payslips, contracts) usually pass through a Go API before a user ever sees them, yet the standard library has no PDF encryption at all. The archived gofpdf can't help and commercial wrappers are heavy, so teams either shell out to qpdf or skip protection entirely.
rust-pdf implements AES-256 (V5/R6) directly, deriving the file key, salts and IVs from the operating system CSPRNG so every output file is unique, with AES-128 and legacy RC4 still on hand for older readers. qpdf validates the result for both the user and the owner password.
Inside a net/http or Gin handler you load the document, call Encrypt, and write the secured bytes straight to the ResponseWriter with Content-Type application/pdf. Every call returns an explicit error rather than panicking, so a missing Encryption license surfaces as a clean 500 instead of crashing the request.
- AES-256 (V5/R6) with keys and IVs from the OS CSPRNG, plus AES-128 and RC4 for legacy needs.
- Separate user and owner passwords, with a read-only permission mode.
- Encrypt new documents or an existing PDF you load and re-save.
Encrypt a PDF in Go with rust-pdf
Install with go get, then call the same idiomatic API every rust-pdf binding shares. The snippet below is real Go code from the reference docs.
go get github.com/rustpdf/rustpdf-go
data, _ := os.ReadFile("in.pdf")
ed, _ := rustpdf.Load(data)
defer ed.Close()
if err := ed.Encrypt(rustpdf.AES256, "", "owner-secret", true); err != nil {
log.Fatal(err) // *Error without an Encryption license
}
_ = ed.Save("secured.pdf")Go basic generation is free. Encryption is a corporate feature, unlocked by one offline license token. See pricing & licensing.
Full Go reference in the documentation.
Encryption in Go: FAQ
How strong is the encryption?
rust-pdf uses AES-256 with the modern V5/R6 security handler, the strongest standard PDF encryption. Keys, salts and IVs come from the operating system CSPRNG, so every encrypted file is unique. qpdf validates the output for both user and owner passwords.
What is the difference between user and owner passwords?
A user password is required to open the document. An owner password leaves the file openable but restricts actions such as printing or copying. You can set either or both, and enable a read-only permission mode.
Do I need a license to encrypt in Go?
Encryption is a corporate feature and needs an active license token. Basic generation in Go is free. The same offline token enables encryption in every language.
How do I cross-compile this for a Linux Docker image from a Mac?
Set CGO_ENABLED=1 with a Linux cross toolchain (for example zig cc or a golang:bookworm builder), compile inside a multi-stage Dockerfile, and copy libpdf_ffi.so next to the binary in the final stage. The Encrypt call is byte-for-byte identical on every target.
Ship encrypted PDFs from your Go services
One Rust core, identical encrypted output across every binding. Generation is free in Go; unlock AES-256 with a single offline token when you ship.