> For the complete documentation index, see [llms.txt](https://docs.apryse.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apryse.com/web/security/xod-and-encryption.md).

# Secure Documents with DRM Support for Document Viewing

Ensure your documents are secure with DRM support for document viewing. Encrypt PDFs with custom security handlers to prevent unauthorized access, or convert to XOD files with 128-bit AES encryption f

{% hint style="info" %}
**Requirements**

*These packages are required to use these features in production. Trial keys have unlimited access to all features*

<a href="https://apryse.com/capabilities#Security" class="button primary">Package: Security</a><a href="https://showcase.apryse.com/password-protect" class="button primary">Live demo</a>
{% endhint %}

## Encrypting with PDF

WebViewer supports loading PDFs that are encrypted with an Apryse custom security handler. You will perform the encryption on the server side, choosing an application custom id and password and then WebViewer can decrypt them on the client side. Event if the document was downloaded outside of WebViewer, this security handler prevents other PDF viewers from decrypting the document.

See [this guide](/web/security/custom-handler.md) for more information about DRM with PDF files.

## Encrypting with XOD

An alternative is encrypting with XOD files. When deploying a [custom server](/web/custom-server/custom-server-deployment.md), WebViewer can convert a wide range of document formats to XOD (a web optimized XPS file format).

XOD documents can be encrypted at conversion time and WebViewer can view these documents when supplied with the password. These XOD documents are encrypted with 128 bit AES (Advanced Encryption Standard), a specification from the National Institute of Standards and Technology (NIST), and is used by governments and businesses worldwide.

This enables you to implement certain forms of DRM which can be useful if you want users to only be able to view documents inside the viewer and not simply download the files to view any time outside of it.

* For example a web magazine viewer would likely not want users to simply download the magazines and send them to their friends. Note that the files may be able to be downloaded but they would be unviewable since they would be encrypted.
* Another option would be that the server doesn't store the password, the user just has to enter it in the viewer before they can view the document, effectively password protecting the document.

### Encrypt a document during XOD conversion

To encrypt a XOD document on conversion, you just need to pass in a password to encrypt the document with. You can call the `ToXod` method with `XodOutputOptions`. You can specify the password in the `XodOutputOptions` by calling `SetEncryptPassword`.

### Decrypt a document on client-side

On the client-side, you will have to make some modifications to decrypt an encrypted XOD file. When using WebViewer you include an `encryption` property on the options object of WebViewer:

{% tabs %}
{% tab title="JavaScript" %}
{% code lineNumbers="true" %}

```js
WebViewer({
  initialDoc: 'test.xod',
  encryption: {
    p: 'pass',
    type: 'aes',
    error: msg => { alert(msg); }
  }
}, viewerElement);
```

{% endcode %}
{% endtab %}
{% endtabs %}

[WebViewerInstance](https://sdk.apryse.com/api/web/WebViewerInstance.html)

If you want to load a second password protected document you'll pass the encryption options to loadDocument:

{% tabs %}
{% tab title="JavaScript (SDK v8.0+)" %}
{% code lineNumbers="true" %}

```js
WebViewer(...)
  .then(instance => {
    const { Encryption } = instance.Core;

    instance.UI.loadDocument('newdoc.xod', {
      decrypt: Encryption.decrypt,
      decryptOptions: {
        p: 'newpass',
        type: 'aes',
        error: msg => { alert(msg); }
      }
    });
  });
```

{% endcode %}

[WebViewerInstance.UI.loadDocument](https://sdk.apryse.com/api/web/UI.html#loadDocument__anchor) [Core](https://sdk.apryse.com/api/web/Core.html)
{% endtab %}

{% tab title="JavaScript (SDK v6.0+)" %}
{% code lineNumbers="true" %}

```js
WebViewer(...)
  .then(instance => {
    const { CoreControls } = instance;

    instance.loadDocument('newdoc.xod', {
      decrypt: CoreControls.Encryption.decrypt,
      decryptOptions: {
        p: 'newpass',
        type: 'aes',
        error: msg => { alert(msg); }
      }
    });
  });
```

{% endcode %}

[WebViewerInstance.loadDocument](https://sdk.apryse.com/api/web/UI.html#.loadDocument) [CoreControls](https://sdk.apryse.com/api/web/Core.html)
{% endtab %}
{% endtabs %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.apryse.com/web/security/xod-and-encryption.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.