What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To password-protect a PDF generated by PHP, encrypt it through your PDF library as part of document creation. If you use Adobe PDF Services instead, PHP cURL can send a protection job, but the documented operation takes an Adobe asset ID—not arbitrary PDF bytes—and the service performs the encryption. Choose the local route when the PDF is already being built in PHP; choose the hosted route when your workflow can use Adobe’s asset and job lifecycle.
Choose where the PDF gets encrypted
| Approach | Best fit | What PHP does | What you need |
|---|---|---|---|
| Encrypt during local generation with tc-lib-pdf | Your PHP application creates the PDF and you want encryption in that generation workflow. | Build the document with the PDF library and supply its encryption configuration. | Composer, PHP 8.2 or later, and the required PHP extensions. |
| Adobe PDF Services Protect PDF operation | You want a hosted service to protect an existing service asset. | Authenticate, create or obtain an asset, submit its asset ID and protection settings, then handle the job result and retrieve the output. | Adobe service credentials, network access, and code for the asset/job lifecycle. |
These are different workflows, not interchangeable cURL recipes. cURL is an HTTP client: it can send a request to Adobe, but it does not itself encrypt a PDF. For a PDF your PHP application is generating, the local library route avoids sending the file to a hosted protection API by design. If you use a hosted service, review the provider’s current terms for data handling, retention, residency, and pricing; those details are not established here.
Protect a PDF while generating it with tc-lib-pdf
The current Tecnick stack documents an encryption object accepted by the tc-lib-pdf constructor, as well as a separate encryption component. Its encryption example configures encryption as enabled, sets user and owner passwords, selects AES-256 R6, and supplies permissions. Install the packages you need with Composer:
composer require tecnickcom/tc-lib-pdf
composer require tecnickcom/tc-lib-pdf-encryptThe project’s package requirements include PHP 8.2 or later. The encryption component also lists the ctype, hash, openssl, and pcre extensions. Confirm the installed package’s current API and requirements before implementing against it.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Configure encryption in the library
Use the encryption component’s documented configuration object and pass it to the tc-lib-pdf constructor. The documented example’s settings are:
- Enable encryption.
- Set a user password, which is used to gate opening the document.
- Set an owner password, which is used to configure or administer permissions.
- Choose a supported encryption mode, such as AES-256 R6, based on recipient-reader compatibility.
- Set any desired permission restrictions.
The constructor accepts an Encrypt|null object. The precise PHP class names, namespaces, and method signatures depend on the installed package version; use the current tc-lib-pdf and tc-lib-pdf-encrypt documentation rather than copying an old TCPDF snippet. The current stack is not a drop-in guarantee for legacy TCPDF APIs. In particular, do not infer that an older SetProtection()-style call is supported by the newer package.
One important compatibility exception: tc-lib-pdf ignores the encryption object in PDF/A mode because that conformance mode forbids encryption. If PDF/A output is a requirement, you cannot satisfy it by simply enabling encryption on the same output; resolve the conflicting document requirements first.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use PHP cURL with Adobe PDF Services
Adobe’s documented Protect PDF REST operation is POST https://pdf-services.adobe.io/operation/protectpdf. Its JSON example includes a passwordProtection value, an encryptionAlgorithm, and an assetID. The user-password example uses AES_128; the owner-password example uses AES_256. Adobe documents support for AES-128 and AES-256.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The following PHP example shows the protection request once you have obtained a valid access token and an asset ID through the service’s authenticated asset workflow. Replace the placeholders with secrets and values from your own Adobe setup. This is not the complete upload-and-download workflow: you must first obtain the asset ID, then follow the service’s response/job flow and retrieve the resulting asset content.
<?php
$accessToken = getenv('ADOBE_ACCESS_TOKEN');
$apiKey = getenv('ADOBE_CLIENT_ID');
$assetId = getenv('ADOBE_PDF_ASSET_ID');
$password = getenv('PDF_OPEN_PASSWORD');
if (!$accessToken || !$apiKey || !$assetId || !$password) {
throw new RuntimeException('Set the Adobe token, client ID, asset ID, and PDF password.');
}
$payload = [
'passwordProtection' => $password,
'encryptionAlgorithm' => 'AES_128',
'assetID' => $assetId,
];
$ch = curl_init('https://pdf-services.adobe.io/operation/protectpdf');
curl_setopt_array($ch, [
CURLOPT_POST => true,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
'x-api-key: ' . $apiKey,
'Authorization: Bearer ' . $accessToken,
'Content-Type: application/json',
],
CURLOPT_POSTFIELDS => json_encode($payload, JSON_THROW_ON_ERROR),
CURLOPT_TIMEOUT => 90,
]);
$responseBody = curl_exec($ch);
$statusCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($responseBody === false) {
$error = curl_error($ch);
curl_close($ch);
throw new RuntimeException('Adobe request failed: ' . $error);
}
curl_close($ch);
if ($statusCode < 200 || $statusCode >= 300) {
throw new RuntimeException('Adobe returned HTTP ' . $statusCode . ': ' . $responseBody);
}
$result = json_decode($responseBody, true, 512, JSON_THROW_ON_ERROR);
header('Content-Type: application/json');
echo json_encode($result, JSON_PRETTY_PRINT | JSON_THROW_ON_ERROR);
This snippet checks transport errors and non-success HTTP status codes, then prints the service response for inspection. Adapt the response handling to the actual job/result fields returned by your current Adobe workflow: a successful protection submission does not necessarily mean the finished PDF bytes are already in this response. Adobe’s documented workflow submits a job, retrieves its result, and then retrieves and writes the resulting asset content.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use the owner-password flow when that is your goal
Adobe also documents an owner-password example. Use the field and request shape in the current owner-password documentation rather than treating a user/open password as an owner credential. The distinction matters: an open password gates access to the document, while an owner password is associated with configuring or administering document permissions. Keep both values out of source control, application logs, and error messages.
Select encryption for both security and compatibility
Do not use RC4 for new documents. The tc-lib-pdf-encrypt documentation calls RC4-40 and RC4-128 broken and deprecated. It describes AES-256 R6 as the current PDF 2.0 option and AES-256 R5 as another recommended mode. The strongest option is not automatically the most compatible option: the project says mode 4 requires a reader implementing ISO 32000-2, and mode 3 requires a reader implementing the PDF 1.7 AES-256 extension. AES-128 has broader compatibility.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Before choosing a mode, identify the PDF readers your recipients actually use. If recipients have older or controlled software, test with that environment before rolling out a mode with narrower reader support. The documentation does not establish compatibility for every reader, so do not promise that a particular mode will work everywhere.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Understand what password protection does—and does not do
User password: require a password to open
A user password is the relevant choice when the requirement is that a recipient must authenticate before reading the PDF. Use a unique, sufficiently strong secret; keep it in a secret manager or protected application configuration, not in the PDF-generation source code. Deliver the password to the recipient through a separate trusted channel from the file.
Owner password and permissions: restrictions depend on the reader
PDF permission settings can request limits on actions such as printing, editing, or copying. They are not a guarantee that recipients cannot reproduce visible content. Tecnick’s documentation describes permission flags as advisory: a cooperating reader honours them, and enforcement rests with the reader. Encryption is what makes the content unreadable without authentication. Do not describe permission flags as unbreakable DRM or promise they prevent screenshots, photography, or other capture of content a person can view.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot common implementation failures
- The Composer install or class loading fails. Confirm PHP is 8.2 or later, install the packages your implementation uses, and check that the required extensions—especially
opensslfor the encryption component—are enabled in the PHP runtime running your application. - The constructor rejects the encryption object. Check the installed tc-lib-pdf version and its constructor signature. The current stack documents an
Encrypt|nullargument; do not assume a legacy TCPDF method or signature applies. - The generated file is PDF/A. tc-lib-pdf ignores encryption in PDF/A mode because encryption is forbidden for that conformance mode. Revisit whether PDF/A or encryption is the actual requirement.
- A recipient’s reader cannot open the encrypted PDF. Check the chosen AES mode against the reader’s supported PDF specifications. AES-256 R6/mode 4 has a newer reader requirement than broader-compatibility AES-128; test with the actual recipient software.
- Adobe returns an authorization error. Verify the API key and bearer token are valid for the current service setup, are sent in the documented headers, and have not expired. Never print the secret values while debugging.
- Adobe reports a missing or invalid asset. The Protect PDF request refers to an
assetID. Complete the asset creation/upload step and pass the returned ID; posting raw PDF bytes to the protection operation is not the documented request shown here. - The request succeeds but no PDF is saved. Handle the service’s job/result response, retrieve the resulting asset content, and write those bytes to a file. A successful submission response is not necessarily the PDF itself.
- The output opens without prompting or permissions seem ineffective. Confirm that the intended password type and configuration were used, and test with a cooperating PDF reader. Permissions are advisory; they do not make viewable content impossible to capture.
Or skip the browser setup
ScreenshotNeo is a website screenshot API and MCP server, not a PDF password-protection service. It is relevant if your PHP workflow also needs website captures; it does not encrypt or password-protect a PDF. For a site screenshot, one GET request can return an image or PDF. Example using cURL:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsBest Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo API documentation for request options. It removes cookie/consent banners, newsletter popups, and chat widgets before capture; bot checks, blank pages, and failed loads are never billed; and its MCP server lets AI agents take screenshots. The free plan includes 1,000 screenshots a month with no card, and paid plans start at $5 for 3,000. Learn more at ScreenshotNeo, or sign up free for 1,000 screenshots a month with no card.
FAQ
Can I use PHP cURL alone to encrypt a locally generated PDF?
No. cURL sends HTTP requests; use a PDF library to encrypt locally, or send a protection request to a hosted service that performs the encryption.
Does the Adobe protection request upload my PDF?
The documented protection request uses an asset ID. The broader workflow must first create or upload an asset and later retrieve the protected result.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
