Password protection

Written for mPDF 8.2 on PHP 8.1+. Updated 2 November 2026.

SetProtection() encrypts the PDF and can require a password to open it.

$mpdf->SetProtection(
    ['print', 'copy'],     // what a reader may do without the owner password
    'open-sesame',         // user password: needed to open the file ('' for none)
    'a-long-owner-secret', // owner password: lifts all restrictions
    128                    // key length in bits; always use 128
);
$mpdf->WriteHTML($html);
$mpdf->Output('statement.pdf', 'D');

Call it before writing content.

Permissions

The first argument lists what’s allowed. Anything you leave out is blocked.

Permission	Allows
`print`	Printing.
`print-highres`	Full-quality printing (otherwise viewers may print at low resolution).
`copy`	Selecting and copying text and images.
`modify`	Changing the document.
`annot-forms`	Adding comments and filling forms.
`fill-forms`	Filling form fields only.
`extract`	Extracting content for accessibility tools.
`assemble`	Inserting, rotating or deleting pages.

An empty array with no user password makes a file that anyone can open but, in well-behaved viewers, not print or copy from.

What protection really does

The opening (user) password is real protection. Without it the content can’t be decrypted. Make it long and send it a different way from the file.
Permissions are a polite request. Mainstream viewers respect them, but plenty of tools ignore them. Never rely on “no copy” for confidential material.
Use 128-bit keys. The 40-bit default dates from export-control days and can be broken quickly. mPDF’s encryption also predates AES-256. For the strongest protection, encrypt the finished file with a tool such as qpdf, or our Protect PDF tool, which uses AES-256 in your browser.

Removing protection

To strip a password from a PDF you own (you’ll need the password), use Unlock PDF.