Encryption · Node.js and TypeScript
Encrypt a PDF in Node.js
Password-protect a PDF from Node.js with AES-256 encryption. rust-pdf applies standard-handler encryption at output, deriving keys and IVs from the operating system CSPRNG, and supports user and owner passwords plus permission flags.
Last updated: 2026-06-29
Why Node.js and TypeScript needs this
Handling confidential PDFs in Node usually means shelling out to qpdf or another CLI, then babysitting temp files and passwords on disk, awkward inside a request handler and easy to leak.
Encryption keeps sensitive documents (statements, records, contracts) confidential and helps meet LGPD, GDPR and HIPAA obligations. rust-pdf implements AES-256 (V5/R6) directly, validated by qpdf for both user and owner passwords, and also supports AES-128 and legacy RC4.
Drop the load–encrypt–save sequence into an Express or NestJS route to protect a document per request. The Koffi binding is pure FFI with no node-gyp build, so it installs cleanly from npm, and a request made without an Encryption license throws a PdfError you handle in a try/catch like any other failure.
- AES-256 (V5/R6) with keys and IVs from the OS CSPRNG, plus AES-128 and RC4 for legacy needs.
- Separate user and owner passwords, with a read-only permission mode.
- Encrypt new documents or an existing PDF you load and re-save.
Encrypt a PDF in Node.js with rust-pdf
Install from npm, then encrypt in three calls — load, encrypt, save — with user and owner passwords and an optional read-only mode. The snippet below is real Node.js from the reference docs.
npm install rustpdf
const { EditableDoc, Encryption } = require("rustpdf");
const ed = EditableDoc.loadFile("in.pdf");
ed.encrypt({ user: "", owner: "owner-secret",
method: Encryption.Aes256, readOnly: true });
ed.save("secured.pdf"); // throws PdfError without an Encryption license
ed.close();Node.js basic generation is free. Encryption is a corporate feature, unlocked by one offline license token. See pricing & licensing.
The full Node.js encryption reference is in the documentation.
Encryption in Node.js: FAQ
How strong is the encryption?
rust-pdf uses AES-256 with the modern V5/R6 security handler, the strongest standard PDF encryption. Keys, salts and IVs come from the operating system CSPRNG, so every encrypted file is unique. qpdf validates the output for both user and owner passwords.
What is the difference between user and owner passwords?
A user password is required to open the document. An owner password leaves the file openable but restricts actions such as printing or copying. You can set either or both, and enable a read-only permission mode.
Do I need a license to encrypt in Node.js?
Encryption is a corporate feature and needs an active license token. Basic generation in Node.js is free. The same offline token enables encryption in every language.
Does the Koffi binding work in AWS Lambda or Vercel serverless?
Yes. Koffi is pure FFI with no node-gyp compile step, so you ship the prebuilt native library alongside your function and load it at cold start. AES-256 encryption behaves the same in a Lambda or Vercel handler as on a long-running Express server, as long as the Encryption license token is present in the environment.
Ship confidential PDFs without bundling a CLI
One Rust core, identical AES-256 output in every language. Prototype on the free tier, then switch on encryption with a single license token when you ship.