Examples of securing PDFs from command-line

Apryse's PDFSecure is a command-line application designed to add, remove, or change security settings on existing PDF documents or whole directories of documents. PDFSecure can also be used to modify document information metadata and to web-optimize files through a process known as linearization. This section covers the basic use of PDFSecure explaining all the available options.

The basic command-line syntax is:

pdfsecure [options] file1 file2 folder1 file3 ...

See more options in:

• Command-Line Summary
• Permission Options
• Document Information Options

Notes:

• The '-o' parameter is used to specify the output file. If the output filename was not specified, PDFSecure will prompt you for a permission to modify the original file.
• The '-s' parameter specifies that the output document should be encrypted using 128 bit RC4 encryption.
• The '-u' parameter specifies the password required to access the secured document.

pdfsecure -o test_out/ex1/blue_secret.pdf -s 128 -u secret test/blue.pdf

Notes:

• Because there is more than one input file, the '-o' parameter is used to specify the destination folder ('test_out/ex2') instead of a filename.
• The '-s' parameter specifies that the output document should be encrypted using AES (Advanced Encryption Standard) encryption. AES and Crypt filters are supported in PDF 1.6 (Acrobat 7) and higher.

pdfsecure -o test_out/ex2 -s AES -u secret test

Notes:

• In this example, the '-w' parameter is used to specify the owner (or permission) password and the '-d' parameter is used to disable all permissions.

pdfsecure -o test_out/ex3/r1.pdf -s 128 -u userpass -w ownerpass -d a test/red.pdf

Notes:

• In this example, the '-e' parameter is used to selectively enable high and low resolution printing on all PDF documents located under the 'test' folder, while disabling all other permissions.
• The '--subfolders' parameter is used to indicate that PDFSecure should recursively process all subfolders.

pdfsecure -o test_out/ex4 -s 128 -w foo -d mcofxs -e ph --subfolders test

• The following example disables any modifications to the document except commenting, and enables content extraction (such as copy and paste).

pdfsecure -o test_out/ex4/out2.pdf -s 128 -w foo -d ms -e cox test/red.pdf

Notes:

• The '-s' parameter specifies that encryption should be removed from all documents.
• This sample decrypts files generated in Example 4. Because these files are only protected using an owner (permission) password, PDFSecure does not require any password to remove the security.

pdfsecure -o test_out/ex5 -s R test test_out/ex4/out2.pdf

pdfsecure -o test_out/ex5 -s R test test_out/ex4

• Files that are secured in examples 1, 2 and 3 are protected with a user (or open) password and this password is required to remove the security. The password required to open input documents is specified using the '--p' parameter. If the user password is not specified, PDFSecure prompts the user for a valid password.

pdfsecure -o test\_out/ex5/ex3r1.pdf -s R -p userpass test_out/ex3/r1.pdf

pdfsecure -o test_out/ex5 -s R -p secret test_out/ex2/test --subfolders

pdfsecure -o test_out/ex5/e1.pdf -s R -p secret test_out/ex1/blue_secret.pdf

Notes:

• Using PDFSecure it is possible to modify document information metadata (e.g. Author, Subject, Title, Keywords, etc.) on individual documents or uniformly across document collections. For example:

pdfsecure -o test_out/ex6 --title "My Title" --subject "My Subject" --creator "Source App" --producer "PDFSecure" --author "Joe Doe" --keywords "key1 key2 key3" test

Notes:

• In order to provide good performance over relatively slow communication links, PDFSecure can generate PDF documents with linearized objects and hint tables that can allow a PDF viewer application to download and view one page of a PDF file at a time, rather than requiring the entire file (including fonts and images) to be downloaded before any of it can be viewed. In this example, the '--l' parameter is used to specify that all processed documents should be linearized.

pdfsecure -o test_out/ex7 -l test_out/ex6

Notes:

• With PDFSecure it is possible to combine different operations described above in a single command-line. For example:

pdfsecure -o test_out/ex8 -l --title "My Title" --subject "My Subject" --creator "SourceApp"- producer "PDFSecure" --author "Joe Doe" --keywords "key1 key2 key3" -s AES -u userpass -w ownerpass -d chsmx -e of test

The above command-line:

• Applies linearization to all output documents.
• Sets various parameters in document information dictionary.
• Secures all output documents using AES (Advanced Encryption Standard) encryption.
• Sets the user (open) password to 'userpass'.
• Sets the owner (permission) password to 'ownerpass'
• Disables high-resolution printing, content extraction, and document modification (including document assembly), but enables commenting and form filling.

PDFSecure supports processing of multiple input documents in the same run. For example, it is possible to specify multiple PDF folders and PDFSecure will automatically process all PDF documents matching a given file extension. For example, the following command-line will process all PDF documents in folders 'test1' and 'test2'

c:\>pdfsecure -o c:/output_folder -s 128 -u secret c:/test1 c:/test2

Wildcard characters can also be used to process multiple input files.

For example, if a directory contains the following PDF documents:

1C:\test1 >dir
2 Directory of C:\test1
3 01/04/2007 03:35 PM <DIR> .
4 01/04/2007 03:35 PM <DIR> ..
5 05/21/2004 02:27 PM A1.pdf
6 05/03/2005 09:38 AM A2.pdf
7 05/20/2003 08:46 AM B1.pdf
8 05/15/2003 12:50 PM B2.pdf

To process all PDF documents in this folder, you could specify:

pdfsecure -o c:/output_folder -s 128 -u secret c:/test1/*.pdf

To process all PDF documents starting with 'A', you could specify:

pdfsecure -o c:/output_folder -s 128 -u secret c:/test1/A*.pdf

Or to process all PDF documents ending with '1', you could specify:

pdfsecure -o c:/output_folder -s 128 -u secret c:/test1/*1.pdf

You can use either of the two standard wildcards --- the question mark (?) and the asterisk (*) --- to specify filename and path arguments on the command line.

The wildcards are expanded in the same manner as operating system commands. (Please refer to your operating system user's guide if you are unfamiliar with wildcards). Enclosing an argument in double quotation marks (" ") suppresses the wildcard expansion. Within quoted arguments, you can represent quotation marks literally by preceding the double-quotation-mark character with a backslash (\). If no matches are found for the wildcard argument, the argument is passed literally.