Encryption · Ruby
Encrypt a PDF in Ruby
Password-protect a PDF from Ruby with strong AES-256 encryption. rust-pdf applies standard-handler encryption at output, deriving keys and IVs from the operating system CSPRNG, and supports user and owner passwords plus permission flags.
Last updated: 2026-06-29
Why Ruby needs this
Ruby teams reach for Prawn to draw documents, but Prawn never shipped encryption, so the moment a statement or a payslip has to be password-protected you end up shelling out to a qpdf binary on the server. rust-pdf closes that gap from inside the process.
Encryption keeps sensitive documents confidential and helps you meet LGPD, GDPR and HIPAA duties. rust-pdf implements AES-256 (V5/R6) directly, with the file key, salts and IVs drawn from the operating system CSPRNG so every output is unique, plus AES-128 and legacy RC4 for older readers.
Install the universal-darwin gem and it binds through Fiddle in the standard library, so an encrypt action in a Rails controller or a Sidekiq worker can call ed.encrypt and rescue RustPdf::Error when the Encryption license token is missing, with no C toolchain on the box.
- AES-256 (V5/R6) with keys and IVs from the OS CSPRNG, plus AES-128 and RC4 for legacy needs.
- Separate user and owner passwords, with a read-only permission mode.
- Encrypt new documents or an existing PDF you load and re-save.
Encrypt a PDF in Ruby with rust-pdf
Install with RubyGems, then call the same idiomatic API every rust-pdf binding shares. The snippet below is real Ruby code from the reference docs.
gem install rustpdf
ed = RustPdf::EditableDoc.load_file("in.pdf")
ed.encrypt(method: RustPdf::Cipher::AES256, owner: "owner-secret", read_only: true)
ed.save("secured.pdf") # raises RustPdf::Error without an Encryption license
ed.closeRuby basic generation is free. Encryption is a corporate feature, unlocked by one offline license token. See pricing & licensing.
Full Ruby reference in the documentation.
Encryption in Ruby: FAQ
How strong is the encryption?
rust-pdf uses AES-256 with the modern V5/R6 security handler, the strongest standard PDF encryption. Keys, salts and IVs come from the operating system CSPRNG, so every encrypted file is unique. qpdf validates the output for both user and owner passwords.
What is the difference between user and owner passwords?
A user password is required to open the document. An owner password leaves the file openable but restricts actions such as printing or copying. You can set either or both, and enable a read-only permission mode.
Do I need a license to encrypt in Ruby?
Encryption is a corporate feature and needs an active license token. Basic generation in Ruby is free. The same offline token enables encryption in every language.
Can I encrypt inside a Rails controller or a Sidekiq job?
Yes. The gem loads its native core through Fiddle, so you can encrypt an EditableDoc and stream it back from a controller action or a background worker. Wrap the call in begin/rescue to handle RustPdf::Error when the Encryption license token is not active.
Ship encrypted PDFs from Ruby with confidence
One Rust core, the same output across every language. Prototype for free, license the corporate features when you ship.