> For the complete documentation index, see [llms.txt](https://docs.apryse.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apryse.com/web/security/xod-and-encryption.md).

# Secure Documents with DRM Support for Document Viewing

Ensure your documents are secure with DRM support for document viewing. Encrypt PDFs with custom security handlers to prevent unauthorized access, or convert to XOD files with 128-bit AES encryption f

{% hint style="info" %}
**Requirements**

*These packages are required to use these features in production. Trial keys have unlimited access to all features*

<a href="https://apryse.com/capabilities#Security" class="button primary">Package: Security</a><a href="https://showcase.apryse.com/password-protect" class="button primary">Live demo</a>
{% endhint %}

## Encrypting with PDF

WebViewer supports loading PDFs that are encrypted with an Apryse custom security handler. You will perform the encryption on the server side, choosing an application custom id and password and then WebViewer can decrypt them on the client side. Event if the document was downloaded outside of WebViewer, this security handler prevents other PDF viewers from decrypting the document.

See [this guide](/web/security/custom-handler.md) for more information about DRM with PDF files.

## Encrypting with XOD

An alternative is encrypting with XOD files. When deploying a [custom server](/web/custom-server/custom-server-deployment.md), WebViewer can convert a wide range of document formats to XOD (a web optimized XPS file format).

XOD documents can be encrypted at conversion time and WebViewer can view these documents when supplied with the password. These XOD documents are encrypted with 128 bit AES (Advanced Encryption Standard), a specification from the National Institute of Standards and Technology (NIST), and is used by governments and businesses worldwide.

This enables you to implement certain forms of DRM which can be useful if you want users to only be able to view documents inside the viewer and not simply download the files to view any time outside of it.

* For example a web magazine viewer would likely not want users to simply download the magazines and send them to their friends. Note that the files may be able to be downloaded but they would be unviewable since they would be encrypted.
* Another option would be that the server doesn't store the password, the user just has to enter it in the viewer before they can view the document, effectively password protecting the document.

### Encrypt a document during XOD conversion

To encrypt a XOD document on conversion, you just need to pass in a password to encrypt the document with. You can call the `ToXod` method with `XodOutputOptions`. You can specify the password in the `XodOutputOptions` by calling `SetEncryptPassword`.

### Decrypt a document on client-side

On the client-side, you will have to make some modifications to decrypt an encrypted XOD file. When using WebViewer you include an `encryption` property on the options object of WebViewer:

{% tabs %}
{% tab title="JavaScript" %}
{% code lineNumbers="true" %}

```js
WebViewer({
  initialDoc: 'test.xod',
  encryption: {
    p: 'pass',
    type: 'aes',
    error: msg => { alert(msg); }
  }
}, viewerElement);
```

{% endcode %}
{% endtab %}
{% endtabs %}

[WebViewerInstance](https://sdk.apryse.com/api/web/WebViewerInstance.html)

If you want to load a second password protected document you'll pass the encryption options to loadDocument:

{% tabs %}
{% tab title="JavaScript (SDK v8.0+)" %}
{% code lineNumbers="true" %}

```js
WebViewer(...)
  .then(instance => {
    const { Encryption } = instance.Core;

    instance.UI.loadDocument('newdoc.xod', {
      decrypt: Encryption.decrypt,
      decryptOptions: {
        p: 'newpass',
        type: 'aes',
        error: msg => { alert(msg); }
      }
    });
  });
```

{% endcode %}

[WebViewerInstance.UI.loadDocument](https://sdk.apryse.com/api/web/UI.html#loadDocument__anchor) [Core](https://sdk.apryse.com/api/web/Core.html)
{% endtab %}

{% tab title="JavaScript (SDK v6.0+)" %}
{% code lineNumbers="true" %}

```js
WebViewer(...)
  .then(instance => {
    const { CoreControls } = instance;

    instance.loadDocument('newdoc.xod', {
      decrypt: CoreControls.Encryption.decrypt,
      decryptOptions: {
        p: 'newpass',
        type: 'aes',
        error: msg => { alert(msg); }
      }
    });
  });
```

{% endcode %}

[WebViewerInstance.loadDocument](https://sdk.apryse.com/api/web/UI.html#.loadDocument) [CoreControls](https://sdk.apryse.com/api/web/Core.html)
{% endtab %}
{% endtabs %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.apryse.com/web/security/xod-and-encryption.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.