Recommended Free Tools
Use a PDF-aware library and apply its protection settings before you write or output the file. For an application already using mPDF, the shortest working path is SetProtection() with a user (open) password, an owner password, and an explicit permission list. The user password controls whether a reader may open the document; the owner password represents unrestricted access for changing permissions. Permission flags such as copying or printing are separate controls and depend on the PDF reader honoring them.
What password protection means in a PDF
PDF protection has two related but different goals:
- Opening protection: a reader prompts for the user password before displaying the document.
- Operation permissions: the encryption dictionary records whether copying, printing, editing, form filling, or assembly is allowed.
Do not treat a permission flag as an equivalent to an open password. A document can open without a password yet discourage copying, or it can require a password and still allow selected operations. Permission enforcement is ultimately performed by the PDF reader; compliant readers normally honor the flags, but you should not promise that every tool will prevent copying or printing.
mPDF: the practical implementation
Install and confirm your version
This example targets the mPDF API that exposes SetProtection(). Install mPDF with Composer in the application that generates the document, and check the installed package’s manual because supported encryption options vary by version. mPDF documents 40-bit and 128-bit settings; some permissions require 128-bit mode.
#1 Best Overall
- 【Strong Adsorption】The inspiration of the silicone phone suction case comes from the adhesive force of the octopus. Each suction cup phone mount is 3.15 inches long and 2.17 inches wide, with 24 independent suction cups providing a stronger and more stable suction force, so you don't have to worry about your phone falling during use.
- 【Back of Phone Suction Grip】Remove the adhesive film on the phone suction cup and stick it on the phone case. You can then fix the phone on any smooth surface, which is very convenient. (The phone suction cup cannot be removed and reused after being attached to the phone case. It is recommended to attach it to a regular phone case, not a valuable one.)
- 【Widely Used】Our non-slip silicone phone sticky grip mount attaches to almost any flat phone case and make it compatible with common mobile phones such as iPhone and Android.You can shoot, watch videos or video calls in the kitchen, gym, dance studio, bathroom and other places.
- 【Capture the Wonderful Picture】Whether you are a TikTok creator or just like to share videos and photos, this phone suction cup can help you hands-free capture wonderful videos and photos for sharing with friends.
- 【Note】You can fix the phone suction cup on a smooth surface such as a mirror or glass. If necessary, wipe the suction cup with a damp cloth to obtain stronger suction. Before releasing your hand, make sure the phone is firmly fixed. (Not applicable to rough walls, wooden surfaces, and other uneven surfaces)
Complete PHP example
<?php
require_once __DIR__ . '/vendor/autoload.php';
$mpdf = new MpdfMpdf([
'format' => 'A4',
]);
// First argument: permissions that remain available to the recipient.
// The second argument is the user/open password.
// The third argument is the owner password.
$mpdf->SetProtection(
['print', 'copy', 'fill-forms'],
'UserPassword',
'OwnerPassword'
);
$mpdf->WriteHTML('<h1>Protected document</h1><p>Confidential content.</p>');
$mpdf->Output(__DIR__ . '/document.pdf', MpdfOutputDestination::FILE);
Call SetProtection() before Output(); setting it after output has begun is too late. In a web response, you can instead use $mpdf->Output('document.pdf', MpdfOutputDestination::DOWNLOAD). Keep both passwords out of source control, exception messages, access logs, and URLs. Load them from a secret manager or protected environment configuration.
Choose permissions deliberately
mPDF documents these permission names: copy, print, modify, annot-forms, fill-forms, extract, assemble, and print-highres. Pass only what the recipient needs. For example, use ['print'] for a read-and-print handout, or [] when no optional operation should be granted in the protection settings.
At 128-bit mode, mPDF describes print as low-resolution printing. Add print-highres when full-resolution printing is intended. Verify the exact interaction between bit strength and permission names against the mPDF version installed in your project.
Use distinct, strong secrets
The open password is normally shared with recipients. The owner password should be different and known only to an administrator or controlled service. A long, randomly generated value is preferable to a memorable phrase reused elsewhere. Password protection does not secure a password that is emailed in the same unprotected message as the PDF, nor does it protect a copy made after an authorized recipient opens the file.
Rank #2
- SUPERIOR COMFORT — Unlike traditional circular ear buds, the design of EarPods is defined by the geometry of the ear. Which makes them more comfortable for more people than any other ear bud–style headphones.
- HIGH-QUALITY AUDIO — The speakers inside EarPods have been engineered to maximize sound output and minimize sound loss, which means you get high-quality audio.
- BUILT-IN REMOTE — EarPods with USB-C plug also include a built-in remote that lets you adjust the volume, control the playback of music and video, and answer or end calls with a pinch of the cord.
- COMPATIBILITY — Works with all devices that have a USB-C port.
- INTEGRATED MICROPHONE — A built-in microphone precisely captures your voice while you’re on the phone, taking a FaceTime call, or summoning Siri — so you’re always heard loud and clear.
Current TCPDF-family encryption options
If you are starting a new generator or need newer encryption revisions, distinguish the legacy TCPDF codebase from Tecnick’s current tc-lib-pdf and focused tc-lib-pdf-encrypt package. The current package documentation requires PHP 8.2 or newer and Composer installation. Its API is package-specific; it is not a drop-in replacement for mPDF’s SetProtection().
Select an encryption mode for your readers
| Mode | Documented algorithm/revision | When to consider it |
|---|---|---|
| 4 | AES-256 R6, PDF 2.0 | Preferred for new documents when recipient readers support ISO 32000-2/PDF 2.0. |
| 3 | AES-256 extension for PDF 1.7 | Useful when AES-256 is required but PDF 2.0 reader support is uncertain. |
| 2 | AES-128 | Broader compatibility with older readers that support AES. |
| 0–1 | Legacy RC4 modes | Do not select for new work; the project marks RC4 modes deprecated and broken. |
Mode 4 is not automatically the right answer for every audience. Identify the actual desktop, mobile, browser, and embedded readers that will receive the file, then test an encrypted sample with those versions. Stepping down to a compatible AES mode is preferable to delivering a file recipients cannot open.
Passwords, permissions, and certificates
The tc-lib-pdf-encrypt documentation also separates user and owner passwords and exposes permission flags. Its guidance treats those flags as reader-enforced permissions, not an absolute anti-copy mechanism. If you use certificate encryption, keep certificates and private keys outside source trees and container images; inject them through a protected secret mechanism.
PDF/A and other conformance requirements
Encryption can conflict with archival conformance. Tecnick’s standards documentation states that encryption is not permitted in PDF/A mode and that the encryption object is ignored. Decide whether the deliverable must be PDF/A before adding password protection. If archival conformance is mandatory, produce an unencrypted archival copy or obtain a requirements-approved alternative rather than assuming both properties can coexist.
Rank #3
- Secure Hold: Our PopSockets adhesive phone grip gives your cell phone a secure, comfortable hold in hand to help prevent drops while texting, taking photos, or scrolling on the go. Designed to stick firmly to most phone cases and devices.
- Hands-Free Made Easy: Easily turn your PopSocket into a phone stand to prop up your phone anywhere — perfect for watching videos, video calls, or following recipes. A must-have phone holder that keeps your device secure and ready for anything.
- Compatibility: Works with all phones, tablets, and Kindles. Sticks best to smooth, hard plastic cases and may not adhere to silicone or textured cases. Easily swap your PopTop to change up your style — just close the grip, press down, twist 90°, and snap on a new top.
- Black PopSockets: Simple, refined, and endlessly versatile — a timeless essential for any phone.
- PopSockets Ecosystem: Mix and match your favorite PopSockets products — from grips and wallets to cases and mounts — all designed to work together seamlessly.
Why generic PHP encryption is not a PDF password feature
openssl_encrypt() encrypts arbitrary bytes; it does not construct a PDF encryption dictionary, and PHP documents that its passphrase argument is not processed by a key-derivation function. Padding or truncation does not turn a string into a password-protected PDF. Encrypting the completed PDF as a generic blob also means a normal PDF reader cannot open it directly. Use the generator’s PDF-aware protection API or a dedicated PDF encryption package.
Avoid legacy mcrypt encryption filters for new code. PHP marks them deprecated since PHP 7.1 and discourages relying on them. They do not solve the PDF-format problem either.
Testing a protected output
- Generate a file with a non-empty user password and a separate owner password.
- Open it in at least one desktop reader and one browser or mobile reader used by your recipients. Confirm that the open prompt appears.
- Test each intended permission: print, copy text, edit, fill forms, and assemble pages. Record the reader and version because enforcement differs.
- Try the owner password and verify that administrative operations are available.
- Inspect the delivered file, not only an in-memory response, and ensure no password appears in logs, temporary filenames, or HTTP query strings.
- If you claim PDF/A or another profile, validate that profile separately; an ordinary successful open does not prove conformance.
Or skip the browser setup
If your PHP workflow also needs a clean image of a public web page—for example, to document the generated PDF’s landing page—ScreenshotNeo provides a single screenshot API call. It accepts consent banners before capture and removes more than 60 known consent platforms, newsletter popups, and chat widgets; bot checks, blank pages, failed loads, timeouts, and cache hits are not billed. Its MCP server exposes take_screenshot, get_page_info, and capture_pdf to Claude, Cursor, and other MCP clients. The Free plan includes 1,000 shots per month without a card; paid plans start at $5 for 3,000 shots.
See the ScreenshotNeo API documentation for request options. A cURL request is:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpCreate a free ScreenshotNeo account to get the 1,000 monthly shots with no card.
Rank #4
- [360 ° Flexible Rotation Design] Comes with a rotatable lanyard ring that supports 360 ° free rotation, effectively solving the problem of twisted and tangled lanyards
- [Wide compatibility] The ultra-thin 0.02-inch design does not block the charging port at all, and both wired and wireless charging can be used directly without removing the pad. Compatible with most smartphones such as iPhone, compatible with various wristbands, lanyards, crossbody straps, and keychains
- [Durable and Portable Material] Premium rust-resistant stainless steel material with good flexibility, which not only avoids scratching the phone case, but also has excellent anti rust and anti fading performance
- [Multi scenario Practical] Paired with a lanyard or wristband, hands-free use can be achieved. The phone is within reach and not easily dropped, ideal for daily commuting and outdoor activities. Suitable for full coverage phone cases, does not support half coverage phone cases
- [Quality Service] If you find any damage or other issues with the product upon receipt, please contact us immediately. We will handle it quickly
Complete examples in other common languages
Python
import requests
r = requests.get(
"https://api.screenshotneo.com/v1/shot",
params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"},
timeout=90,
)
r.raise_for_status()
open("shot.webp", "wb").write(r.content)
Node.js
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);
if (!res.ok) throw new Error(`Screenshot failed: ${res.status}`);
const fs = await import('node:fs/promises');
await fs.writeFile('shot.webp', Buffer.from(await res.arrayBuffer()));
Troubleshooting
The PDF opens without asking for a password
Confirm that the user password argument is non-empty, that SetProtection() runs on the same mPDF instance that writes the file, and that it executes before Output(). Check that you are opening the newly generated file rather than a cached download.
Printing or copying still works
Permission flags are advisory and reader-dependent. Confirm the exact flag names and encryption strength supported by your mPDF version, then test another compliant reader. Do not use this mechanism as a substitute for access control or data-loss prevention.
An older reader reports an unsupported security handler
The selected revision may be too new. Test a compatible AES mode, such as the documented AES-128 mode, while avoiding deprecated RC4 modes. Record the minimum reader versions you support and make the choice explicit in deployment documentation.
PDF/A validation fails
Remove encryption from the PDF/A output or change the requirement. The cited tc-lib-pdf standards guidance says encryption is not permitted in PDF/A mode.
Best Value
- 【PKYAA Double Sided Silicone Suction Phone Case Mount】PKYAA With Double Sided 40 Strong and Reliable individual suction cups, PKYAA provides a thicken and upgraded universal silicon suction mount for your phone.
- 【Friendly to Content Creators】If you are a content creator or an online influencer, you can create videos anywhere with this suction mount completely hands free with this silicone cell phone mount for cases.
- 【HANDS-FREE & Adhere to Mirrors】This Double Sided silicone suction phone case mount allows you to stick your phone to the mirror easily. No longer holding your phone in one hand to watch video tutorials while making up.
- 【Strong Grip on the Smooth Surface】You can easily hang your phone anywhere with a smooth surface. All you do is you clean off your phone and smooth surface. It is STURDY and it not only sticks to mirrors, it also sticks to windows, it sticks to refrigerators, tiles and other clean, flat surfaces.
- 【Press Down Firmly Every 30 Minutes】Use your palm or fingers to press the phone down firmly and check it's secure before letting go. Apply even pressure for a few seconds to allow the suction cup to adhere properly. To maintain the grip and prevent accidental falls, it's a good practice to periodically reapply pressure to the suction cup.
Secrets appear in logs
Redact request parameters and exception context, rotate exposed passwords, and move credentials to a secret manager or protected environment. Never place them in Composer files, container layers, or client-side JavaScript.
Choosing between mPDF and tc-lib-pdf-encrypt
| Requirement | Practical choice |
|---|---|
| Your application already renders with mPDF | Use mPDF’s SetProtection() to minimize migration work. |
| New project on PHP 8.2+ | Evaluate current tc-lib-pdf-encrypt and its mode 4 AES-256 R6 support. |
| Recipients include older PDF readers | Choose a tested compatible AES revision, not simply the newest mode. |
| PDF/A is mandatory | Plan for an unencrypted PDF/A deliverable because encryption is disallowed in that mode. |
| You need an open password | Configure a user password; permissions alone do not create an open prompt. |
FAQ
Can I use the same password for user and owner access?
You can, but separate values preserve the distinction between recipient access and administrative control and reduce the impact of disclosure.
Does encryption stop screenshots?
No. Once an authorized reader can display a page, the operating system or another camera can capture its appearance. PDF encryption protects the file and records permissions; it is not a complete content-control system.
Free tools Windows power users keep installed
One-click scans. No signup required.
Should I encrypt every generated PDF?
Apply it when confidentiality or controlled operations justify the compatibility and support cost. For public, indexable documents, encryption can prevent previews, search indexing, and automated processing.
Frequently Asked Questions
Can a password-protected PDF be opened by a server-side PDF parser?
Usually only if that parser supports the selected PDF encryption revision and you provide the appropriate password. Verify this in the parser’s documentation before choosing mode 4 or another newer revision.
What should I do when recipients forget the open password?
Generate a new copy with a new user password through an authenticated recovery workflow. The owner password is not a safe substitute for recipient identity verification.
The Bottom Line
For mPDF, configure SetProtection() before writing the document, use a distinct user and owner password, and select permissions with the understanding that readers enforce them. For new PHP 8.2+ work, evaluate tc-lib-pdf-encrypt mode 4 when your recipient readers support PDF 2.0; otherwise choose a tested compatible AES mode. Keep PDF/A outputs unencrypted when conformance is required.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
