PDF security is often misunderstood. Many developers assume that securing a PDF simply means setting a password. However, PDF security consists of several independent mechanisms that solve different problems.

For example, encryption protects document content from unauthorized access. Permissions define what users can do after opening the document. Digital signatures protect the document's integrity and authenticity by proving that it has not been altered since it was signed.

This article explains these concepts and demonstrates how to implement them using TX Text Control in C# .NET.

PDF Encryption

Encryption protects the content of a PDF document. If a user password is set, the PDF viewer will prompt the user to enter the password before opening the document.

using TXTextControl;

using var tx = new ServerTextControl();

tx.Create();

tx.Text = "This is a confidential PDF document.";

var saveSettings = new SaveSettings
{
    UserPassword = "user1234"
};

tx.Save(
    "encrypted.pdf",
    StreamType.AdobePDF,
    saveSettings
);

The generated PDF requires a password to open. This is the most important protection mechanism for ensuring confidentiality.

User Password and Master Password

PDF documents can have two different types of passwords. A user password is required to open the document. The master password, also known as the owner password, controls the document's permissions. When a master password is set, the PDF viewer prompts the user to enter the password when they attempt to change permissions or perform restricted actions.

using TXTextControl;

using var tx = new ServerTextControl();

tx.Create();

tx.Text = "This PDF allows only limited operations.";

var saveSettings = new SaveSettings
{
    UserPassword = "user1234",
    MasterPassword = "owner1234",
    DocumentAccessPermissions = DocumentAccessPermissions.AllowLowLevelPrinting |
                                DocumentAccessPermissions.AllowExtractContents
};

tx.Save("secured.pdf", StreamType.AdobePDF, saveSettings);

In this example, users need the password to open the document. However, the master password is required to change the security settings.

PDF Permissions

Permissions determine what actions users can perform on a PDF document after opening it. For instance, you can allow or disallow printing, copying content, or modifying the document. Although permissions are enforced by PDF viewers, they are not a security mechanism since they can easily be bypassed if the user has access to the document.

TX Text Control supports permission flags through the DocumentAccessPermissions property:

A common enterprise scenario involves a document that can be viewed and printed but not edited. This can be achieved by setting the permissions as follows:

var saveSettings = new SaveSettings
{
    UserPassword = "user1234",
    MasterPassword = "owner1234",
    DocumentAccessPermissions = DocumentAccessPermissions.AllowLowLevelPrinting |
                                DocumentAccessPermissions.AllowContentAccessibility
};

It's important to understand that permissions and encryption are not the same. Encryption protects access to content. Permissions instruct compliant PDF viewers which actions are allowed.

The Myth of PDF Permissions

PDF permissions are often misunderstood. For example, disabling printing or copying does not provide the same level of protection as encryption.

A compliant PDF viewer respects permission flags. However, permissions are not a cryptographic security boundary. Once a user can open and decrypt a document, the effectiveness of permissions depends on viewer support.

Therefore, permissions should be used as part of a document policy, not as the sole security mechanism.

Verifying PDF Encryption Programmatically

In automated workflows, assuming that encryption worked is not enough. Verify encryption by trying to load the document without a password. This attempt should fail. Then, load the document again with the correct password.

using TXTextControl;

public static bool VerifyPdfEncryption(
    ServerTextControl sourceTextControl,
    string userPassword,
    string destinationPath)
{
    sourceTextControl.Save(
        destinationPath,
        StreamType.AdobePDF,
        new SaveSettings
        {
            UserPassword = userPassword
        });

    using var verificationControl = new ServerTextControl();

    verificationControl.Create();

    try
    {
        verificationControl.Load(destinationPath, StreamType.AdobePDF);
        return false;
    }
    catch (FilterException)
    {
        verificationControl.Load(
            destinationPath,
            StreamType.AdobePDF,
            new LoadSettings
            {
                UserPassword = userPassword
            });

        return true;
    }
}

This approach is useful for server-side document pipelines in which security requirements must be automatically verified before documents are delivered or archived.

Digital Signatures

Encryption answers the question:

Who can read this document?

Digital signatures answer a different question:

Has this document been changed, and who signed it?

Digital signatures are an essential part of PDF security. They verify the authenticity and integrity of a document. A digital signature is created using a certificate containing the signer's public key. When a document is signed, a hash of its content is created and encrypted with the signer's private key. This encrypted hash is the digital signature.

A digitally signed PDF is cryptographically linked to a certificate. If the document is modified after signing, the signature becomes invalid.

using System.Security.Cryptography.X509Certificates;
using TXTextControl;

using var tx = new ServerTextControl();

tx.Create();

tx.Text = "This is a signed PDF document.";

var certificate = new X509Certificate2(
    "textcontrolself.pfx",
    "123");

var saveSettings = new SaveSettings
{
    DigitalSignature = new DigitalSignature(
        certificate,
        null)
};

tx.Save(
    "signed.pdf",
    StreamType.AdobePDF,
    saveSettings);

This signs the entire PDF document. Although the signature is invisible, PDF viewers such as Adobe Acrobat Reader can validate it and display its status.

Signing Signature Fields

In addition to signing the entire document, you can also sign specific signature fields. This allows for multiple signatures in a document, each with its own validation status. TX Text Control can create signature fields and bind them to digital certificates during PDF export.

using System.Drawing;
using System.Security.Cryptography.X509Certificates;
using TXTextControl;

using var tx = new ServerTextControl();

tx.Create();

var signatureField = new SignatureField(
    new Size(2000, 2000),
    "txsign",
    10);

signatureField.Image = new SignatureImage(
    "signature.svg",
    0);

tx.SignatureFields.Add(signatureField, -1);

var certificate = new X509Certificate2(
    "textcontrolself.pfx",
    "123");

var digitalSignature = new DigitalSignature(
    certificate,
    null,
    "txsign");

var saveSettings = new SaveSettings
{
    SignatureFields = new[]
    {
        digitalSignature
    }
};

tx.Save(
    "signed-field.pdf",
    StreamType.AdobePDF,
    saveSettings);

This approach is useful for contracts, approvals, consent forms, and other documents where signatures must be visible.

Adding Signer Information and Time Stamps

When signing a document, you can include additional information, such as the signer's name, the reason for signing, and the location. You can also add a timestamp to show when the document was signed. This information is displayed in the signature details of supported PDF viewers.

using System.Security.Cryptography.X509Certificates;
using TXTextControl;

using var tx = new ServerTextControl();

tx.Create();

tx.Load(
    "signature.tx",
    StreamType.InternalUnicodeFormat);

var certificate = new X509Certificate2(
    "textcontrolself.pfx",
    "123");

const string timeStampServer =
    "http://timestamp.digicert.com";

var digitalSignatures = new List<DigitalSignature>();

foreach (SignatureField signatureField in tx.SignatureFields)
{
    signatureField.SignerData = new SignerData(
        "John Doe",
        "CEO",
        "11 Main Street, New York, NY 10001, USA",
        "john@doe.com",
        "Contract signature");

    digitalSignatures.Add(
        new DigitalSignature(
            certificate,
            timeStampServer,
            signatureField.Name));
}

tx.Save(
    "signed-with-timestamp.pdf",
    StreamType.AdobePDFA,
    new SaveSettings
    {
        CreatorApplication = "Your Application",
        SignatureFields = digitalSignatures.ToArray()
    });

In long-term validation scenarios, time stamps are important because they help prove when a document was signed.

Encryption vs Digital Signatures

Encryption and digital signatures serve different purposes. Encryption protects the confidentiality of a document, while digital signatures ensure its integrity and authenticity. A document can be encrypted without being signed, and it can be signed without being encrypted.

Secure workflows often use both mechanisms. For instance, an HR system might encrypt payroll reports to keep them confidential and then digitally sign them to show that the document hasn't been altered.

Enterprise Workflow Example

Consider an enterprise document management system that generates PDF reports containing sensitive information. The system must ensure that only authorized users can access the reports and provide a way to verify that they haven't been tampered with.

A typical secure document workflow could look like this:

1. Generate a document from a DOCX template.
2. Merge business data into the template.
3. Export the result to PDF.
4. Encrypt the PDF with a user password.
5. Set permissions to restrict editing.
6. Digitally sign the final PDF.
7. Deliver or archive the document.

This automated process combines confidentiality, controlled usage, integrity, and authenticity. By using TX Text Control's PDF security features, developers can implement robust document workflows that meet enterprise security requirements.

Conclusion

PDF security encompasses more than just password protection.

Encryption protects confidential content. Permissions define how viewers can use the document. Digital signatures ensure the document's integrity and authenticity.

With TX Text Control, you can integrate these mechanisms directly into .NET document workflows. Using one consistent API, developers can generate, encrypt, restrict, sign, verify, and archive PDF documents.

This is especially important for enterprise applications. Contracts, invoices, medical records, HR documents, financial reports, and compliance documents require more than simple PDF generation. They require secure, reliable, and verifiable document processing.

Frequently Asked Questions