Security

Create password-protected PDFs with the security prop.

Security options

import type { PdfSecurityOptions } from 'vue-pdf-export'

const security: PdfSecurityOptions = {
  enabled: true,
  userPassword: 'open123',
  ownerPassword: 'owner456',
  permissions: ['print', 'copy'],
}

<Html2Pdf :security="security" />

Password protection works in both canvas and selectable-text render modes.

Permission flags

type PdfPermission = 'print' | 'modify' | 'copy' | 'annot-forms'

PDF permission enforcement depends on the PDF viewer. Password encryption is part of the PDF itself, while permission flags rely on viewer compliance.

Security guidance

The package can generate encrypted/password-protected PDFs, but PDF security should be treated as one layer of application security rather than a replacement for access control.

Important boundaries:

• User/open password controls opening an encrypted PDF.
• Owner password is used by the PDF encryption layer for owner-level access/permission configuration.
• Permission flags are viewer-dependent. Some PDF viewers may not enforce them identically.
• headerHtml and footerHtml are intentionally trusted developer HTML. Do not pass unsanitized user-controlled HTML.
• Remote images are fetched by the browser. Use trusted origins, correct CORS headers, and avoid exposing secrets in image URLs.
• Passwords exist in browser memory while a PDF is being generated. Do not hard-code sensitive production passwords into public frontend source.
• Generated Blob URLs are cleaned up by the component/composable lifecycle, but applications should still avoid retaining generated Blobs longer than necessary.

vue-pdf-export is a client-side library and does not require a package-operated server to generate a PDF. Your application, remote assets, analytics, and surrounding infrastructure may still perform their own network requests.

Password parts

const security = {
  enabled: true,
  passwordParts: ['15081999', 4821],
  passwordSeparator: '-',
}

This creates one final open password:

15081999-4821

passwordParts do not create multiple independent passwords.

When security is omitted, compatible raw htmlToPdfOptions.jsPDF.encryption values are preserved.

When security.enabled is explicitly false, encryption is removed.

Security Model & Boundaries

vue-pdf-export provides PDF security features and conservative browser-side cleanup, but no client-side PDF package can make an application "100% secure" by itself.

Verified outcomes

The final regression suite verified:

• 50-page Canvas generation
• 100-page Canvas generation
• Canvas cancellation and recovery
• selectable-text cancellation and recovery
• repeated-image caching in selectable-text mode
• page-bounded Canvas rendering in image-heavy documents
• temporary rendering cleanup after cancellation/generation

The final unit suite completed with:

19 test files passed
106 / 106 tests passed

What the package provides

• jsPDF-backed PDF encryption/password protection
• separate user/open and owner password inputs
• supported permission flags for print, modify, copy, and annotation/forms
• explicit security.enabled: false handling to remove inherited raw encryption
• metadata/compression processing without sending the document to a package-operated backend
• Blob URL cleanup in the component/composable lifecycle
• cancellation cleanup for temporary rendering structures
• filename normalization that removes unsafe path/filename characters and protects Windows reserved names

What remains the application's responsibility

• sanitizing any untrusted HTML before passing it to headerHtml or footerHtml
• protecting passwords, tokens, customer data, and remote asset URLs
• server-side authorization before sensitive data reaches the browser
• selecting CORS-safe and trusted image origins
• deciding whether client-side PDF generation is appropriate for highly sensitive documents
• validating the behavior of permission flags in the PDF viewers used by your customers

Important client-side security note

Anything available to frontend JavaScript can potentially be inspected by a user who controls that browser session. Do not treat a frontend bundle, minification, or obfuscation as a secret-storage mechanism.

Minifying the npm distribution is useful for package size and distribution hygiene, but it is not a security boundary.