Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/bpampuch/pdfmake/llms.txt

Use this file to discover all available pages before exploring further.

pdfmake supports PDF encryption through two complementary password types and a granular permissions system. You can require a password to open the file, set a separate administrative password for full access, and control exactly what readers are allowed to do — all from the document definition object.

​
User Password

Setting userPassword encrypts the PDF and requires the reader to enter the correct password before the document can be opened. If the password is wrong or missing, the viewer will refuse to display the file. 
const docDefinition = {
  userPassword: 'open-me',
  content: ['This document requires a password to open.']
};
The userPassword is stored inside the encrypted PDF. Do not hard-code sensitive passwords in source code that is committed to version control.

​
Owner Password

The ownerPassword grants full, unrestricted access to the document — including the ability to change permissions, print at high resolution, copy text, and so on. Readers who open the file with the owner password bypass all permission restrictions. 
const docDefinition = {
  ownerPassword: 'admin-secret',
  content: ['Only the owner can change permissions.']
};
You can combine both passwords so that end users open the file with userPassword and administrators use ownerPassword to manage it: 
const docDefinition = {
  userPassword: 'open-me',
  ownerPassword: 'admin-secret',
  content: ['Protected document.']
};

​
Permissions

The permissions object lets you fine-tune what actions are permitted for users who open the file with the userPassword. Each flag defaults to the most restrictive value when the ownerPassword is set.
​
printing
'lowResolution' | 'highResolution'
Controls whether printing is allowed, and at what quality. 'highResolution' permits normal printing; 'lowResolution' allows only degraded (draft-quality) printing.
​
modifying
boolean
Whether the reader can modify the document content (edit text, move objects, etc.).
​
copying
boolean
Whether the reader can copy text and graphics from the document.
​
annotating
boolean
Whether the reader can add or modify annotations (comments, highlights, etc.).
​
fillingForms
boolean
Whether the reader can fill in interactive form fields.
​
contentAccessibility
boolean
Whether assistive technology (screen readers) can access the document content.
​
documentAssembly
boolean
Whether the reader can insert, delete, or rotate pages, or create bookmarks and thumbnail images.

​
Full Example

The following example is taken directly from examples/security.js in the pdfmake source repository. It sets an owner password, allows high-resolution printing, and restricts modification and copying while keeping annotation, form-filling, accessibility, and assembly available. 
const pdfmake = require('pdfmake');
const Roboto = require('pdfmake/fonts/Roboto');
pdfmake.addFonts(Roboto);

const docDefinition = {
  // userPassword: '123',        // uncomment to require a password to open
  ownerPassword: '123456',
  permissions: {
    printing: 'highResolution',  // or 'lowResolution'
    modifying: false,
    copying: false,
    annotating: true,
    fillingForms: true,
    contentAccessibility: true,
    documentAssembly: true
  },
  content: [
    'Document content with security',
    'For details see the source or documentation.'
  ]
};

pdfmake.createPdf(docDefinition).write('security.pdf');
Permissions only apply to users opening the file with the userPassword. Anyone who opens the file with the ownerPassword has full access regardless of the permissions object.

​
Access Policies (Node.js)

When running in Node.js, pdfmake can embed remote images, fonts, or other resources referenced by URL or local file path. To prevent unintended network or filesystem access, you should configure access policies before calling createPdf.

​
URL Access Policy

setUrlAccessPolicy(callback) registers a function that is called for every URL pdfmake attempts to fetch. Return true to allow the request and false to block it. 
pdfmake.setUrlAccessPolicy((url) => {
  // Only allow HTTPS URLs; block HTTP and other schemes
  return url.startsWith('https://');
});
If you do not call setUrlAccessPolicy in a Node.js environment, pdfmake will log a warning that no URL access policy is defined. Without a policy, all URLs are permitted.

​
Local File Access Policy

setLocalAccessPolicy(callback) registers a function that is called for every local file path pdfmake attempts to read (for example, font files or local images). Return true to allow access and false to deny it. 
pdfmake.setLocalAccessPolicy((path) => {
  // Allow all local files — adjust to restrict specific directories
  return true;
});
setLocalAccessPolicy is only available on the Node.js build (require('pdfmake')). The browser build does not have access to the local filesystem.
Both policies are set once per pdfmake instance and apply to all subsequent createPdf calls on that instance.

Build docs developers (and LLMs) love

Get started for freeTalk to us