Security Encryption and Decryption Guide

This guide covers encrypt and decrypt operations using the Security class in Aspose.PDF for .NET.

Setup

Apply metered licensing before processing:

using Aspose.Pdf;

Metered metered = new Metered();
metered.SetMeteredKey("publicKey", "privateKey");

Prerequisites

A PDF you want to encrypt or decrypt.
Valid Aspose Metered API key.

Step 1: Encrypt a PDF with a Password

Construct EncryptionOptions with a user password, an owner password, a DocumentPrivilege permission set, and a CryptoAlgorithm, then call Process.

using Aspose.Pdf.LowCode;
using Aspose.Pdf.Facades;

var security = new Security();
var encryptOptions = new EncryptionOptions(
    "userPassword123", "ownerPassword456",
    DocumentPrivilege.ForbidAll, CryptoAlgorithm.AESx256);
encryptOptions.AddInput(new FileDataSource("input.pdf"));
encryptOptions.AddOutput(new FileDataSource("encrypted.pdf"));
security.Process(encryptOptions);

Step 2: Decrypt a PDF

Construct DecryptionOptions with just the owner password; the output file opens with no password required at all.

using Aspose.Pdf.LowCode;
using Aspose.Pdf.Facades;

var security = new Security();
var decryptOptions = new DecryptionOptions("ownerPassword456");
decryptOptions.AddInput(new FileDataSource("encrypted.pdf"));
decryptOptions.AddOutput(new FileDataSource("decrypted.pdf"));
security.Process(decryptOptions);

Step 3: Choose an Encryption Algorithm

CryptoAlgorithm offers RC4x40, RC4x128, AESx128, AESx256, and Custom; swap the algorithm argument to EncryptionOptions to use a different one.

using Aspose.Pdf.LowCode;
using Aspose.Pdf.Facades;

var security = new Security();
var encryptOptions = new EncryptionOptions(
    "userPassword123", "ownerPassword456",
    DocumentPrivilege.ForbidAll, CryptoAlgorithm.RC4x128);
encryptOptions.AddInput(new FileDataSource("input.pdf"));
encryptOptions.AddOutput(new FileDataSource("encrypted.pdf"));
security.Process(encryptOptions);

Step 4: Encrypt Using In-Memory Streams

EncryptionOptions.AddInput and AddOutput accept StreamDataSource for in-memory processing; set CloseOutputStreams to false before calling Process so the output stream stays open for you to read.

using System.IO;
using Aspose.Pdf.LowCode;
using Aspose.Pdf.Facades;

using var inputStream = File.OpenRead("input.pdf");
using var outputStream = new MemoryStream();

var encryptOptions = new EncryptionOptions(
    "userPassword123", "ownerPassword456",
    DocumentPrivilege.ForbidAll, CryptoAlgorithm.AESx256)
{
    CloseOutputStreams = false
};
encryptOptions.AddInput(new StreamDataSource(inputStream));
encryptOptions.AddOutput(new StreamDataSource(outputStream));

var security = new Security();
security.Process(encryptOptions);

// outputStream now contains the encrypted PDF bytes
byte[] encryptedBytes = outputStream.ToArray();

Format Support

The Security class works with any valid PDF document; it reads and writes through FileDataSource or StreamDataSource, so there is no restriction beyond the input being a PDF.

Troubleshooting

Problem	Likely Cause	Fix
Reading the output `MemoryStream` after `Process()` returns gives zero bytes	`CloseOutputStreams` defaults to `true`, so the engine closes the stream before you get a chance to read it	Set `CloseOutputStreams = false` on the options object before calling `Process()`
Setting `AllowPrint = false` on a `DocumentPrivilege` obtained earlier doesn’t carry over to a later `AllowAll`/`ForbidAll` call	`DocumentPrivilege.AllowAll` and `ForbidAll` each return a fresh instance on every access, not a shared singleton	Obtain the preset once, mutate it, then pass that same instance into `EncryptionOptions`
An evaluation watermark appears on the encrypted or decrypted output	Metered licensing was not applied before calling the plugin	Call the Metered setup shown in Setup above before using Security