Encryption · PHP
Encrypt a PDF in PHP
Password-protect a PDF from PHP with strong AES-256 encryption. rust-pdf applies standard-handler encryption at output, deriving keys and IVs from the operating system CSPRNG, and supports user and owner passwords plus permission flags.
Last updated: 2026-06-29
Why PHP needs this
Sensitive PDFs (bank statements, payslips, medical records) should never sit unprotected on disk or ride along as an email attachment. PHP's older PDF libraries offer no real encryption, and bolting on a qpdf shell-out means another binary to install, sandbox and audit.
rust-pdf applies AES-256 (the V5/R6 security handler) at output, deriving the key, salts and IVs from the operating-system CSPRNG so every file is unique. From a Laravel controller you load the document, call encrypt() with an owner or user password and an optional read-only permission mode, then save. qpdf validates both password paths, and AES-128 and legacy RC4 remain available.
Installation is composer require rust-pdf/rustpdf plus PHP's ext-ffi enabled in php.ini; the encryption itself runs in-process, so there is no SaaS round-trip and no temporary plaintext file written to disk. A missing or expired license surfaces as a PdfException you can catch in middleware and turn into a clean 4xx.
- AES-256 (V5/R6) with keys and IVs from the OS CSPRNG, plus AES-128 and RC4 for legacy needs.
- Separate user and owner passwords, with a read-only permission mode.
- Encrypt new documents or an existing PDF you load and re-save.
Encrypt a PDF in PHP with rust-pdf
Pull in the package with Composer, then call the same idiomatic API every rust-pdf binding shares. The encryption snippet below is verbatim from the PHP reference.
composer require rust-pdf/rustpdf
use RustPdf\{EditableDoc, Encryption};
$ed = EditableDoc::loadFile('in.pdf');
$ed->encrypt(Encryption::Aes256, owner: 'owner-secret', readOnly: true)
->save('secured.pdf'); // throws PdfException without an Encryption licenseBasic PDF generation in PHP is free; encryption is a corporate feature unlocked by a single offline license token. See pricing & licensing.
The complete encryption API is in the PHP documentation.
Encryption in PHP: FAQ
How strong is the encryption?
rust-pdf uses AES-256 with the modern V5/R6 security handler, the strongest standard PDF encryption. Keys, salts and IVs come from the operating system CSPRNG, so every encrypted file is unique. qpdf validates the output for both user and owner passwords.
What is the difference between user and owner passwords?
A user password is required to open the document. An owner password leaves the file openable but restricts actions such as printing or copying. You can set either or both, and enable a read-only permission mode.
Do I need a license to encrypt in PHP?
Encryption is a corporate feature and needs an active license token. Basic generation in PHP is free. The same offline token enables encryption in every language.
Do I need to enable the FFI extension in php.ini, and does this work on shared hosting?
rust-pdf reaches its native core through PHP's ext-ffi, so you set ffi.enable=true in php.ini and the platform cdylib must be readable by the process. That rules out most locked-down shared hosting, but it works on any VPS, Docker image or Laravel Forge box where you control php.ini. Encryption then runs in-process, with no plaintext temp file left on disk.
Ship password-protected PDFs from your PHP stack
One Rust core, identical bytes in every language. Encrypt freely while you build, and activate a feature license when the secured files go to production.