PDF Security in C#: Encryption, Permissions, and Protection

Understanding Encryption Standards

User vs Owner Passwords

The user password (or open password) is required to open and view the PDF document, while the owner password (or permissions password) controls what actions users can perform on the document. This dual-password system provides flexible security controls for different document workflows.

The user password acts as the primary barrier to document access. When set, anyone attempting to open the PDF must provide this password. This is the password you'd share with authorized readers who should be able to view the document content. Think of it as the "read access" credential.

The owner password serves a different purpose entirely. An owner password is one used to enable and disable all other security settings. This password controls who can modify the document's security settings, change permissions, or remove protection entirely. Even if users can open a document with their user password, they cannot change its security settings or override permission restrictions without the owner's password.

This separation allows for sophisticated access control scenarios. For example, you might distribute a contract with a user password so all parties can read it, but only the document creator (who holds the owner password) can modify security settings or create a version with different restrictions.

:path=/static-assets/pdf/content-code-examples/tutorials/encrypt-pdf-csharp/encrypt-pdf-csharp-pdf-security-user-owner-passwords--1.cs

using IronPdf;

var pdf = PdfDocument.FromFile("input.pdf");

// User password required to open/view the PDF
pdf.SecuritySettings.UserPassword = "view-access-2024";

// Owner password required to modify security settings
pdf.SecuritySettings.OwnerPassword = "admin-master-key";

// Disable printing for users without owner password
pdf.SecuritySettings.AllowUserPrinting = IronPdf.Security.PdfPrintSecurity.NoPrint;

// Disable copy/paste of content
pdf.SecuritySettings.AllowUserCopyPasteContent = false;

pdf.SaveAs("output-secured.pdf");

Imports IronPdf

Dim pdf = PdfDocument.FromFile("input.pdf")

' User password required to open/view the PDF
pdf.SecuritySettings.UserPassword = "view-access-2024"

' Owner password required to modify security settings
pdf.SecuritySettings.OwnerPassword = "admin-master-key"

' Disable printing for users without owner password
pdf.SecuritySettings.AllowUserPrinting = IronPdf.Security.PdfPrintSecurity.NoPrint

' Disable copy/paste of content
pdf.SecuritySettings.AllowUserCopyPasteContent = False

pdf.SaveAs("output-secured.pdf")

Permission Restriction Framework

Beyond password protection, PDF security includes a comprehensive permissions system that defines exactly what users can do with the document once opened. Permission flags determine whether printing, copying content, editing, annotations, and form data entry are allowed.

The permissions framework operates independently of user passwords. You can set a user password and then specify which operations that user can perform. Alternatively, you can leave the document open without a user password but still restrict certain operations—though this configuration offers limited security since the restrictions can be more easily circumvented without password protection.

Permission controls include:

• Printing restrictions: Control whether users can print at all, and if so, at what quality
• Content extraction: Prevent copying text and images from the document
• Document modification: Restrict editing of the actual document content
• Annotation and commenting: Control whether users can add notes or comments
• Form field manipulation: Determine if users can fill in form fields
• Document assembly: Control page operations like insertion, deletion, or rotation

These granular controls allow you to tailor document security to your specific use case, ensuring users have exactly the access they need—no more, no less.

Installing IronPDF

Before implementing PDF security features, you need to install IronPDF in your .NET project. The library supports .NET Framework, .NET Core, and .NET 5+, making it compatible with virtually any modern .NET application.

You can install IronPDF via NuGet Package Manager Console:

Install-Package IronPdf

Or using the .NET CLI:

dotnet add package IronPdf

Once installed, add the necessary using statements to your code:

using IronPdf;
using IronPdf.Security;

using IronPdf;
using IronPdf.Security;

Imports IronPdf
Imports IronPdf.Security

Setting User Password (Required to Open)

:path=/static-assets/pdf/content-code-examples/tutorials/encrypt-pdf-csharp/encrypt-pdf-csharp-pdf-security-set-user-password--2.cs

using IronPdf;

var pdf = PdfDocument.FromFile("input.pdf");

// Set user password - anyone opening this PDF must provide this password
pdf.SecuritySettings.UserPassword = "Secure#Password2024!";

pdf.SaveAs("output-protected.pdf");

Imports IronPdf

Dim pdf = PdfDocument.FromFile("input.pdf")

' Set user password - anyone opening this PDF must provide this password
pdf.SecuritySettings.UserPassword = "Secure#Password2024!"

pdf.SaveAs("output-protected.pdf")

Setting Owner Password (Required to Edit)

:path=/static-assets/pdf/content-code-examples/tutorials/encrypt-pdf-csharp/encrypt-pdf-csharp-pdf-security-set-owner-password--3.cs

using IronPdf;
using IronPdf.Security;

var pdf = PdfDocument.FromFile("sample-pdf.pdf");

// Owner password enables restrictions without requiring password to open
pdf.SecuritySettings.OwnerPassword = "admin-control-2024";

// Prevent printing without owner password
pdf.SecuritySettings.AllowUserPrinting = PdfPrintSecurity.NoPrint;

// Disable copy/paste functionality
pdf.SecuritySettings.AllowUserCopyPasteContent = false;

// Prevent any editing without owner password
pdf.SecuritySettings.AllowUserEdits = PdfEditSecurity.NoEdit;

pdf.SaveAs("output-owner-protected.pdf");

Imports IronPdf
Imports IronPdf.Security

Dim pdf = PdfDocument.FromFile("sample-pdf.pdf")

' Owner password enables restrictions without requiring password to open
pdf.SecuritySettings.OwnerPassword = "admin-control-2024"

' Prevent printing without owner password
pdf.SecuritySettings.AllowUserPrinting = PdfPrintSecurity.NoPrint

' Disable copy/paste functionality
pdf.SecuritySettings.AllowUserCopyPasteContent = False

' Prevent any editing without owner password
pdf.SecuritySettings.AllowUserEdits = PdfEditSecurity.NoEdit

pdf.SaveAs("output-owner-protected.pdf")

Encryption Strength Options

IronPDF supports 128-bit encryption for secure document protection, which applies automatically when you set passwords or permissions on your PDF documents. The encryption is transparent—you don't need to explicitly configure encryption algorithms or modes, as IronPDF handles this automatically when you apply security settings.

The 128-bit encryption used by IronPDF provides strong protection suitable for business, legal, and most government applications. The encryption is applied at the content level, meaning the actual text, images, and document structure are encrypted, not just access-controlled.

Managing Print Permissions

IronPDF allows you to control printing permissions, helping you manage who can print your PDF documents. Printing restrictions are particularly important for documents containing confidential information, copyrighted material, or data subject to regulatory restrictions.

If print rights are restricted, then the OwnerPassword must be set for the security measure to take effect. This ensures that permission restrictions cannot be easily removed without proper authorization. The following section demonstrates all available print permission levels.

High-Quality vs Low-Quality Print Settings

IronPDF offers sophisticated print permission controls beyond simple allow/deny. The PdfPrintSecurity enumeration provides three levels of print control:

:path=/static-assets/pdf/content-code-examples/tutorials/encrypt-pdf-csharp/encrypt-pdf-csharp-pdf-security-print-quality--4.cs

using IronPdf;
using IronPdf.Security;

// Allow low-resolution printing only (150 DPI)
var pdf1 = PdfDocument.FromFile("input.pdf");
pdf1.SecuritySettings.OwnerPassword = "admin-key-2024";
pdf1.SecuritySettings.AllowUserPrinting = PdfPrintSecurity.PrintLowQuality;
pdf1.SaveAs("output-low-res-print.pdf");

// Disable printing completely
var pdf2 = PdfDocument.FromFile("input.pdf");
pdf2.SecuritySettings.OwnerPassword = "secret-admin-key";
pdf2.SecuritySettings.AllowUserPrinting = PdfPrintSecurity.NoPrint;
pdf2.SaveAs("output-no-print.pdf");

// Allow full high-quality printing
var pdf3 = PdfDocument.FromFile("input.pdf");
pdf3.SecuritySettings.OwnerPassword = "owner-key";
pdf3.SecuritySettings.AllowUserPrinting = PdfPrintSecurity.FullPrintRights;
pdf3.SaveAs("output-full-print.pdf");

Imports IronPdf
Imports IronPdf.Security

' Allow low-resolution printing only (150 DPI)
Dim pdf1 = PdfDocument.FromFile("input.pdf")
pdf1.SecuritySettings.OwnerPassword = "admin-key-2024"
pdf1.SecuritySettings.AllowUserPrinting = PdfPrintSecurity.PrintLowQuality
pdf1.SaveAs("output-low-res-print.pdf")

' Disable printing completely
Dim pdf2 = PdfDocument.FromFile("input.pdf")
pdf2.SecuritySettings.OwnerPassword = "secret-admin-key"
pdf2.SecuritySettings.AllowUserPrinting = PdfPrintSecurity.NoPrint
pdf2.SaveAs("output-no-print.pdf")

' Allow full high-quality printing
Dim pdf3 = PdfDocument.FromFile("input.pdf")
pdf3.SecuritySettings.OwnerPassword = "owner-key"
pdf3.SecuritySettings.AllowUserPrinting = PdfPrintSecurity.FullPrintRights
pdf3.SaveAs("output-full-print.pdf")

NoPrinting: Completely disables printing functionality in the PDF reader. This is the most restrictive option and is useful for documents that should never be printed, such as digital-only licenses or highly confidential information that should remain solely in electronic form.

LowResolutionPrinting: Allows printing but restricts the output quality to low resolution (typically 150 DPI). This option is valuable for documents where you want to allow reference copies to be printed but want to prevent high-quality reproduction. Common use cases include copyrighted materials, preview copies, or draft documents.

FullPrintRights: Permits unrestricted, high-resolution printing. This gives users the same print quality as if the document were unprotected.

Controlling Copy/Paste Operations

Preventing content copying (disabling text and image selection) is a crucial security feature for protecting intellectual property, confidential data, and copyrighted material.

:path=/static-assets/pdf/content-code-examples/tutorials/encrypt-pdf-csharp/encrypt-pdf-csharp-pdf-security-copy-paste--5.cs

using IronPdf;

var pdf = PdfDocument.FromFile("input.pdf");

// Owner password required for copy/paste restrictions
pdf.SecuritySettings.OwnerPassword = "content-protection-key";

// Prevent users from selecting and copying text or images
pdf.SecuritySettings.AllowUserCopyPasteContent = false;

pdf.SaveAs("output-no-copy.pdf");

Imports IronPdf

Dim pdf = PdfDocument.FromFile("input.pdf")

' Owner password required for copy/paste restrictions
pdf.SecuritySettings.OwnerPassword = "content-protection-key"

' Prevent users from selecting and copying text or images
pdf.SecuritySettings.AllowUserCopyPasteContent = False

pdf.SaveAs("output-no-copy.pdf")

When copy/paste is disabled, users cannot select and copy text or images from the PDF. This prevents easy extraction of content for unauthorized use, plagiarism, or data theft. However, it's important to understand that this is a PDF reader enforcement—determined attackers with specialized tools may still be able to extract content, which is why encryption and password protection are important complementary measures.

If AllowUserCopyPasteContent is set to false, the OwnerPassword must also be set for the security measure to take effect, ensuring these restrictions cannot be trivially bypassed.

Restricting Document Editing

Document editing restrictions prevent users from modifying the actual content of your PDFs. Disabling editing capabilities ensures that your document's integrity is maintained and unauthorized changes cannot be made.

:path=/static-assets/pdf/content-code-examples/tutorials/encrypt-pdf-csharp/encrypt-pdf-csharp-pdf-security-editing-restrictions--6.cs

using IronPdf;
using IronPdf.Security;

// Prevent any content modifications
var pdf1 = PdfDocument.FromFile("input.pdf");
pdf1.SecuritySettings.OwnerPassword = "contract-admin-2024";
pdf1.SecuritySettings.AllowUserEdits = PdfEditSecurity.NoEdit;
pdf1.SaveAs("output-locked.pdf");

// Allow page organization only (rotate, reorder, delete pages)
var pdf2 = PdfDocument.FromFile("input.pdf");
pdf2.SecuritySettings.OwnerPassword = "form-admin-key";
pdf2.SecuritySettings.AllowUserEdits = PdfEditSecurity.EditPages;
pdf2.SaveAs("output-edit-pages.pdf");

// Allow all editing operations
var pdf3 = PdfDocument.FromFile("input.pdf");
pdf3.SecuritySettings.OwnerPassword = "draft-admin";
pdf3.SecuritySettings.AllowUserEdits = PdfEditSecurity.EditAll;
pdf3.SaveAs("output-editable.pdf");

Imports IronPdf
Imports IronPdf.Security

' Prevent any content modifications
Dim pdf1 = PdfDocument.FromFile("input.pdf")
pdf1.SecuritySettings.OwnerPassword = "contract-admin-2024"
pdf1.SecuritySettings.AllowUserEdits = PdfEditSecurity.NoEdit
pdf1.SaveAs("output-locked.pdf")

' Allow page organization only (rotate, reorder, delete pages)
Dim pdf2 = PdfDocument.FromFile("input.pdf")
pdf2.SecuritySettings.OwnerPassword = "form-admin-key"
pdf2.SecuritySettings.AllowUserEdits = PdfEditSecurity.EditPages
pdf2.SaveAs("output-edit-pages.pdf")

' Allow all editing operations
Dim pdf3 = PdfDocument.FromFile("input.pdf")
pdf3.SecuritySettings.OwnerPassword = "draft-admin"
pdf3.SecuritySettings.AllowUserEdits = PdfEditSecurity.EditAll
pdf3.SaveAs("output-editable.pdf")

The PdfEditSecurity enumeration provides granular control over what types of edits are permitted:

NoEdit: Completely prevents any modifications to the document content. This is the most restrictive setting and ensures the document cannot be altered in any way.

AddOrModifyTextAnnotations: Allows users to add text annotations and comments but prevents direct modification of the document content. This is useful for review workflows where you want feedback but want to preserve the original document.

FillInFormsAndSignatures: Permits filling in form fields and adding signatures while preventing other edits. This is the standard setting for PDF forms that need to be filled out but not otherwise modified.

DocumentAssemblyAndTextAnnotations: Allows document assembly operations (like page insertion or deletion) as well as text annotations.

AllEditRights: Permits all editing operations without restriction.

Managing Annotations and Comments

AllowUserAnnotations controls whether or not users can annotate the PDF. Annotation control is particularly important in legal, compliance, and collaborative document workflows.

:path=/static-assets/pdf/content-code-examples/tutorials/encrypt-pdf-csharp/encrypt-pdf-csharp-pdf-security-annotations--7.cs

using IronPdf;

var pdf = PdfDocument.FromFile("input.pdf");

// Owner password required for annotation restrictions
pdf.SecuritySettings.OwnerPassword = "legal-admin-2024";

// Prevent adding comments, highlights, or other markup
pdf.SecuritySettings.AllowUserAnnotations = false;

pdf.SaveAs("output-no-annotations.pdf");

Imports IronPdf

Dim pdf = PdfDocument.FromFile("input.pdf")

' Owner password required for annotation restrictions
pdf.SecuritySettings.OwnerPassword = "legal-admin-2024"

' Prevent adding comments, highlights, or other markup
pdf.SecuritySettings.AllowUserAnnotations = False

pdf.SaveAs("output-no-annotations.pdf")

Disabling annotations prevents users from adding comments, highlights, markup, or any other annotations to the document. This ensures the document remains pristine and prevents confusion caused by unauthorized annotations or comments.

Common use cases for disabled annotations include:

• Final versions of legal contracts
• Official company documentation
• Regulatory submissions
• Published reports that should not be marked up
• Certified or notarized documents

Conversely, enabling annotations while restricting editing is valuable for review processes where you want feedback but want to maintain the integrity of the underlying document.

For a more detailed explanation of the code snippets above and to explore additional security functionality, please refer to our comprehensive how-to guide.

Supplying Passwords Programmatically

While loading your PDF file using PdfDocument.FromFile, you can pass the password to open the encrypted PDF as a second parameter. This allows your application to work with protected documents without user intervention.

:path=/static-assets/pdf/content-code-examples/tutorials/encrypt-pdf-csharp/encrypt-pdf-csharp-pdf-security-open-encrypted--8.cs

using IronPdf;

// Open password-protected PDF
var password = "user-access-2024";
var pdf = PdfDocument.FromFile("protected.pdf", password);

// Work with the decrypted document
var text = pdf.ExtractAllText();

// Modify and save
pdf.SaveAs("output-processed.pdf");

// Note: For production, use secure password storage (environment variables, key vaults)

Imports IronPdf

' Open password-protected PDF
Dim password As String = "user-access-2024"
Dim pdf As PdfDocument = PdfDocument.FromFile("protected.pdf", password)

' Work with the decrypted document
Dim text As String = pdf.ExtractAllText()

' Modify and save
pdf.SaveAs("output-processed.pdf")

' Note: For production, use secure password storage (environment variables, key vaults)

This approach is essential for automated workflows where protected PDFs need to be processed programmatically. Common scenarios include:

• Automated document processing pipelines
• Scheduled report generation
• Batch conversion operations
• Integration with document management systems
• Automated archival processes

Important security considerations:

• Never hardcode passwords in your source code
• Use secure configuration management (Azure Key Vault, AWS Secrets Manager, etc.)
• Implement proper access controls for password storage
• Use environment variables or secure configuration files
• Consider using certificate-based security for highly sensitive applications

Removing Security Restrictions

To remove passwords and encryption, use the RemovePasswordsAndEncryption method. This functionality is crucial when you need to strip security from documents, but it requires proper authorization to prevent unauthorized access.

:path=/static-assets/pdf/content-code-examples/tutorials/encrypt-pdf-csharp/encrypt-pdf-csharp-pdf-security-remove-restrictions--9.cs

using IronPdf;

var pdf = PdfDocument.FromFile("protected.pdf", "owner-password-2024");

pdf.SecuritySettings.RemovePasswordsAndEncryption();

pdf.SaveAs("output-unprotected.pdf");

Imports IronPdf

Dim pdf = PdfDocument.FromFile("protected.pdf", "owner-password-2024")

pdf.SecuritySettings.RemovePasswordsAndEncryption()

pdf.SaveAs("output-unprotected.pdf")

Removing all user and owner password security for a PDF document also disables content encryption. The resulting document will be completely unprotected and can be opened, viewed, edited, and printed without any restrictions.

When to remove security:

• Preparing documents for archival systems that cannot handle encrypted PDFs
• Migrating to different security mechanisms
• Creating publicly distributable versions of previously protected documents
• Resolving compatibility issues with older PDF readers
• Preparing documents for integration with systems that require unencrypted input

Batch Processing Encrypted Files

When working with multiple protected PDFs, you can implement batch processing to handle entire directories of encrypted documents efficiently.

:path=/static-assets/pdf/content-code-examples/tutorials/encrypt-pdf-csharp/encrypt-pdf-csharp-pdf-security-batch-processing--10.cs

using IronPdf;
using System;
using System.IO;

string inputDir = "./input";
string outputDir = "./output";

Directory.CreateDirectory(outputDir);

var pdfFiles = Directory.GetFiles(inputDir, "*.pdf");
string password = "batch-process-2024";

foreach (var pdfPath in pdfFiles)
{
    try
    {
        PdfDocument pdf;
        try
        {
            pdf = PdfDocument.FromFile(pdfPath, password);
        }
        catch
        {
            pdf = PdfDocument.FromFile(pdfPath);
        }

        var text = pdf.ExtractAllText();

        pdf.SecuritySettings.RemovePasswordsAndEncryption();

        string fileName = Path.GetFileName(pdfPath);
        string outputPath = Path.Combine(outputDir, fileName);
        pdf.SaveAs(outputPath);
    }
    catch (Exception ex)
    {
        // Handle errors as needed
    }
}

Imports IronPdf
Imports System
Imports System.IO

Dim inputDir As String = "./input"
Dim outputDir As String = "./output"

Directory.CreateDirectory(outputDir)

Dim pdfFiles = Directory.GetFiles(inputDir, "*.pdf")
Dim password As String = "batch-process-2024"

For Each pdfPath In pdfFiles
    Try
        Dim pdf As PdfDocument
        Try
            pdf = PdfDocument.FromFile(pdfPath, password)
        Catch
            pdf = PdfDocument.FromFile(pdfPath)
        End Try

        Dim text = pdf.ExtractAllText()

        pdf.SecuritySettings.RemovePasswordsAndEncryption()

        Dim fileName As String = Path.GetFileName(pdfPath)
        Dim outputPath As String = Path.Combine(outputDir, fileName)
        pdf.SaveAs(outputPath)
    Catch ex As Exception
        ' Handle errors as needed
    End Try
Next

This pattern is valuable for enterprise scenarios where you need to:

• Process entire document repositories
• Apply consistent security policies across document sets
• Migrate encrypted documents to new security standards
• Perform bulk analysis or content extraction from protected documents
• Implement automated compliance workflows

For batch processing, consider implementing:

• Proper error handling for invalid passwords or corrupted files
• Logging of security operations for audit trails
• Progress reporting for long-running operations
• Parallel processing for improved performance on large document sets
• Secure cleanup of temporary decrypted files

Beyond Password Protection

While password protection and encryption form the foundation of PDF security, truly secure document handling requires a layered approach that addresses multiple attack vectors and compliance requirements.

Multi-factor authentication integration: For classified documents, password protection alone is insufficient. Consider implementing systems where PDF access requires both a password and additional authentication factors, such as smart card credentials, hardware security tokens, or biometric verification.

Hardware security modules (HSM): For HSM based solutions, the private key cannot be exported. Instead, firmware on the USB key does the signing. This ensures that cryptographic keys never leave the secure hardware environment, providing the highest level of key protection for digital signatures on classified documents.

Encryption at rest and in transit: Classified documents require protection not only when stored but also during transmission. Implement transport layer security (TLS) for any network transmission of protected PDFs, and ensure storage systems use full-disk encryption with FIPS 140-2 validated encryption modules.

Document Sanitization for Declassification

Sanitizing a classified document removes enough information to reduce the classification from a higher level to a lower one. This process is critical for government agencies and contractors handling classified material that needs eventual public release.

Important: Always remove sensitive content entirely rather than obscuring it visually—see Visual obscuration in the Security Anti-Patterns section for why this matters.

Proper sanitization requires clearing all metadata fields, custom properties, and hidden content programmatically. PDF documents often retain previous versions, comments, and embedded data that can contain classified information. See the Metadata Leaks section below for implementation details and a complete sanitization checklist.

For declassification workflows, implement a multi-step process:

1. Identify classified content requiring redaction
2. Remove (not obscure) classified text and images
3. Strip all metadata and hidden content
4. Remove embedded files and scripts
5. Verify sanitization through automated and manual review
6. Apply appropriate downgraded classification markings
7. Maintain audit trail of declassification actions

Audit Trails and Access Logging

For classified documents, comprehensive audit trails are not just best practice—they're often mandatory under regulations like Executive Order 13526 for national security information.

:path=/static-assets/pdf/content-code-examples/tutorials/encrypt-pdf-csharp/encrypt-pdf-csharp-pdf-security-audit-logging--11.cs

using IronPdf;
using System;
using System.IO;
using System.Text.Json;

var handler = new SecureDocumentHandler();

handler.OpenClassifiedDocument(
    "classified.pdf",
    "classified-password",
    "john.doe@agency.gov",
    "192.168.1.100"
);

handler.LogPrintOperation(
    "classified.pdf",
    "john.doe@agency.gov",
    "192.168.1.100"
);

public class PdfAuditLog
{
    public DateTime Timestamp { get; set; }
    public string Username { get; set; }
    public string Operation { get; set; }
    public string DocumentPath { get; set; }
    public string IpAddress { get; set; }
    public bool Success { get; set; }
    public string Details { get; set; }
}

public class SecureDocumentHandler
{
    private readonly string auditLogPath = "./logs/audit.log";

    public void OpenClassifiedDocument(string documentPath, string password, string username, string ipAddress)
    {
        var auditEntry = new PdfAuditLog
        {
            Timestamp = DateTime.UtcNow,
            Username = username,
            Operation = "OPEN",
            DocumentPath = documentPath,
            IpAddress = ipAddress,
            Success = false,
            Details = ""
        };

        try
        {
            var pdf = PdfDocument.FromFile(documentPath, password);
            auditEntry.Success = true;
            auditEntry.Details = "Document opened successfully";
            LogAuditEntry(auditEntry);
        }
        catch (Exception ex)
        {
            auditEntry.Success = false;
            auditEntry.Details = $"Failed: {ex.Message}";
            LogAuditEntry(auditEntry);
            throw;
        }
    }

    public void LogPrintOperation(string documentPath, string username, string ipAddress)
    {
        var auditEntry = new PdfAuditLog
        {
            Timestamp = DateTime.UtcNow,
            Username = username,
            Operation = "PRINT",
            DocumentPath = documentPath,
            IpAddress = ipAddress,
            Success = true,
            Details = "Document printed"
        };

        LogAuditEntry(auditEntry);
    }

    private void LogAuditEntry(PdfAuditLog entry)
    {
        Directory.CreateDirectory(Path.GetDirectoryName(auditLogPath));
        string jsonEntry = JsonSerializer.Serialize(entry);
        File.AppendAllText(auditLogPath, jsonEntry + Environment.NewLine);
    }
}

Imports IronPdf
Imports System
Imports System.IO
Imports System.Text.Json

Dim handler As New SecureDocumentHandler()

handler.OpenClassifiedDocument("classified.pdf", "classified-password", "john.doe@agency.gov", "192.168.1.100")

handler.LogPrintOperation("classified.pdf", "john.doe@agency.gov", "192.168.1.100")

Public Class PdfAuditLog
    Public Property Timestamp As DateTime
    Public Property Username As String
    Public Property Operation As String
    Public Property DocumentPath As String
    Public Property IpAddress As String
    Public Property Success As Boolean
    Public Property Details As String
End Class

Public Class SecureDocumentHandler
    Private ReadOnly auditLogPath As String = "./logs/audit.log"

    Public Sub OpenClassifiedDocument(documentPath As String, password As String, username As String, ipAddress As String)
        Dim auditEntry As New PdfAuditLog With {
            .Timestamp = DateTime.UtcNow,
            .Username = username,
            .Operation = "OPEN",
            .DocumentPath = documentPath,
            .IpAddress = ipAddress,
            .Success = False,
            .Details = ""
        }

        Try
            Dim pdf = PdfDocument.FromFile(documentPath, password)
            auditEntry.Success = True
            auditEntry.Details = "Document opened successfully"
            LogAuditEntry(auditEntry)
        Catch ex As Exception
            auditEntry.Success = False
            auditEntry.Details = $"Failed: {ex.Message}"
            LogAuditEntry(auditEntry)
            Throw
        End Try
    End Sub

    Public Sub LogPrintOperation(documentPath As String, username As String, ipAddress As String)
        Dim auditEntry As New PdfAuditLog With {
            .Timestamp = DateTime.UtcNow,
            .Username = username,
            .Operation = "PRINT",
            .DocumentPath = documentPath,
            .IpAddress = ipAddress,
            .Success = True,
            .Details = "Document printed"
        }

        LogAuditEntry(auditEntry)
    End Sub

    Private Sub LogAuditEntry(entry As PdfAuditLog)
        Directory.CreateDirectory(Path.GetDirectoryName(auditLogPath))
        Dim jsonEntry As String = JsonSerializer.Serialize(entry)
        File.AppendAllText(auditLogPath, jsonEntry & Environment.NewLine)
    End Sub
End Class

Essential audit elements:

• Access events: Log every document open, view, print, and close operation
• User identification: Record the authenticated identity of everyone accessing the document
• Timestamp: Maintain precise time records with synchronized clocks
• Operation type: Distinguish between viewing, printing, editing, and other operations
• Outcome: Record success or failure of operations
• Source information: Capture IP addresses, machine identifiers, and location data where available

Audit log protection: Audit logs themselves become sensitive and must be protected:

• Store logs separately from the documents they track
• Apply encryption to audit data
• Implement append-only log storage to prevent tampering
• Use cryptographic signatures to ensure log integrity
• Regular backup to secure, off-site locations
• Define retention periods consistent with regulatory requirements

Combining Encryption with Digital Signatures

Digital signatures provide authentication and integrity for PDF documents. By using IronPDF, you can ensure that your document is signed by a verified source and that it hasn't been altered since the signature was applied.

For classified documents, combining encryption with digital signatures provides both confidentiality and authenticity:

:path=/static-assets/pdf/content-code-examples/tutorials/encrypt-pdf-csharp/encrypt-pdf-csharp-pdf-security-digital-signatures--12.cs

using IronPdf;
using IronPdf.Signing;
using System.Security.Cryptography.X509Certificates;

var pdf = PdfDocument.FromFile("input.pdf");

// Apply encryption
pdf.SecuritySettings.UserPassword = "view-classified-2024";
pdf.SecuritySettings.OwnerPassword = "admin-classified-2024";

// Digital signature requires external certificate file (certificate.pfx)
// In production: use certificates from trusted Certificate Authorities and secure hardware (HSM)
var certificate = new X509Certificate2("certificate.pfx", "cert-password");

var signature = new PdfSignature(certificate)
{
    SignatureContact = "security@agency.gov",
    SignatureReason = "Document Certification",
    SignatureLocation = "Washington DC, USA"
};

pdf.Sign(signature);

pdf.SaveAs("output-signed-encrypted.pdf");

Imports IronPdf
Imports IronPdf.Signing
Imports System.Security.Cryptography.X509Certificates

Dim pdf = PdfDocument.FromFile("input.pdf")

' Apply encryption
pdf.SecuritySettings.UserPassword = "view-classified-2024"
pdf.SecuritySettings.OwnerPassword = "admin-classified-2024"

' Digital signature requires external certificate file (certificate.pfx)
' In production: use certificates from trusted Certificate Authorities and secure hardware (HSM)
Dim certificate = New X509Certificate2("certificate.pfx", "cert-password")

Dim signature = New PdfSignature(certificate) With {
    .SignatureContact = "security@agency.gov",
    .SignatureReason = "Document Certification",
    .SignatureLocation = "Washington DC, USA"
}

pdf.Sign(signature)

pdf.SaveAs("output-signed-encrypted.pdf")

Digital signature components for classified documents:

Certificate chain validation: The permitted uses of a certificate are listed in the ASN.1 encoded extension attributes of the certificate. For classified documents, ensure certificates are issued by approved Certificate Authorities and include proper Extended Key Usage attributes.

Timestamp authority: Any timestamp should also include the Timestamp Service Authority (TSA) certificate. This provides cryptographic proof of when the document was signed, essential for legal and compliance requirements.

Long-term validation (LTV): For documents requiring validation years into the future (common with classified material), implement LTV signatures that include all validation information within the document itself, ensuring signature verification even if certificate authorities are no longer accessible.

Non-repudiation: Digital signatures provide non-repudiation—the signer cannot deny having signed the document. This is crucial for classified documents where accountability and attribution are paramount.

For more detailed guidance on implementing digital signatures with IronPDF, refer to our detailed signing tutorial.

Easily Bypassed "Security" Methods

Many approaches that appear to provide security are trivially defeated by anyone with basic knowledge or freely available tools.

JavaScript-based protection: It is useless because you have to rely on users having JS enabled in their viewing app. Users can modify JS in the browser, block or stop code execution. Never rely on JavaScript for security enforcement, as it operates entirely within the user's control.

Password obscurity: Using weak passwords, predictable patterns, or relying on obscurity rather than strength provides no real protection. Common mistakes include:

• Using document titles or dates as passwords
• Sequential numbers or repeated characters
• Default passwords like "password" or "12345"
• Sharing passwords through insecure channels
• Storing passwords in the PDF properties or metadata

Visual obscuration: Adding an image layer over sensitive text to obscure it, without removing the underlying text provides no security. The original text remains in the PDF structure and can be extracted with basic PDF tools or even simple copy-paste operations.

Proprietary "encryption": Some systems claim to use proprietary encryption algorithms. This violates Kerckhoffs's principle—security should rely on key secrecy, not algorithm secrecy. Always use well-established, peer-reviewed encryption standards like AES.

JavaScript Vulnerabilities in PDFs

Despite efforts by Adobe to limit the impact of malicious JavaScript, it remains a vector that sophisticated attackers can exploit to compromise data, users, and their devices.

The JavaScript threat landscape:

CVE-2024-4367 allows attackers to execute arbitrary JavaScript code when a malicious PDF file is opened. This vulnerability, which affected PDF.js (used by millions of websites and Firefox), demonstrates how PDF JavaScript can be exploited for remote code execution.

Common JavaScript attack vectors in PDFs:

Code execution: Malicious macros and embedded scripts with weak controls allow embedded code to run on open, installing malware or granting unauthorized access. JavaScript in PDFs can access local file systems, make network connections, and execute arbitrary code in some contexts.

Data exfiltration: Sensitive data could be leaked to hackers without your knowledge, such as form data, login credentials, and local files. JavaScript can read form fields, access document content, and transmit data to remote servers.

Cross-site scripting (XSS): In environments where PDF.js is embedded without adequate security measures, this vulnerability could enable Cross-site Scripting (XSS) attacks, data breaches, unauthorized actions, or even full account takeovers.

Mitigation strategies:

:path=/static-assets/pdf/content-code-examples/tutorials/encrypt-pdf-csharp/encrypt-pdf-csharp-pdf-security-javascript-mitigation--13.cs

using IronPdf;
using IronPdf.Rendering;

var pdf = PdfDocument.FromFile("input.pdf");

// Prevent JavaScript injection by disabling editing
pdf.SecuritySettings.OwnerPassword = "admin-secure-2024";
pdf.SecuritySettings.AllowUserEdits = IronPdf.Security.PdfEditSecurity.NoEdit;

pdf.SaveAs("output-hardened.pdf");

Imports IronPdf
Imports IronPdf.Rendering

Dim pdf = PdfDocument.FromFile("input.pdf")

' Prevent JavaScript injection by disabling editing
pdf.SecuritySettings.OwnerPassword = "admin-secure-2024"
pdf.SecuritySettings.AllowUserEdits = IronPdf.Security.PdfEditSecurity.NoEdit

pdf.SaveAs("output-hardened.pdf")

Additional protective measures:

• Implement Content Security Policy (CSP) headers when displaying PDFs in web applications
• Disable JavaScript in PDFs. Many exploits take advantage of JavaScript vulnerabilities
• Use PDF readers with sandboxing capabilities to isolate PDF execution
• Keep PDF software updated to patch known vulnerabilities
• Implement network-level filtering to block connections from PDF JavaScript
• Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites

Metadata Leaks in "Secured" Documents

:path=/static-assets/pdf/content-code-examples/tutorials/encrypt-pdf-csharp/encrypt-pdf-csharp-pdf-security-metadata-sanitization--14.cs

using IronPdf;
using System;
using System.Linq;

var pdf = PdfDocument.FromFile("input.pdf");

// Remove all standard metadata
pdf.MetaData.Author = "";
pdf.MetaData.Title = "";
pdf.MetaData.Subject = "";
pdf.MetaData.Keywords = "";
pdf.MetaData.Creator = "";
pdf.MetaData.Producer = "";

// Apply neutral metadata
pdf.MetaData.Title = "Document";
pdf.MetaData.Subject = "General Information";
pdf.MetaData.Producer = "PDF Generator";

pdf.SaveAs("output-sanitized.pdf");

Imports IronPdf
Imports System
Imports System.Linq

Dim pdf = PdfDocument.FromFile("input.pdf")

' Remove all standard metadata
pdf.MetaData.Author = ""
pdf.MetaData.Title = ""
pdf.MetaData.Subject = ""
pdf.MetaData.Keywords = ""
pdf.MetaData.Creator = ""
pdf.MetaData.Producer = ""

' Apply neutral metadata
pdf.MetaData.Title = "Document"
pdf.MetaData.Subject = "General Information"
pdf.MetaData.Producer = "PDF Generator"

pdf.SaveAs("output-sanitized.pdf")