How to Protect, Redact & Sign PDF Files
The Security group of the Advanced PDF Editor wraps the three operations that close any document workflow: password protection, visual redaction, and a signature studio. All three are ISO 32000-2 compliant and run entirely inside the browser tab.
No document ever leaves your browser.
The Security Group at a Glance
The Security group sits at the right end of the toolbar. It contains three tools — Protect, Unlock, and Sign — plus a dedicated Redact annotation tool that lives in the Annotate group but ships with security semantics. Together they cover every closing-document operation: encrypt for transit, sanitize before sharing, and stamp with your identity.
Encrypt with a password using AES-256.
When to use: Sharing drafts, sensitive contracts, archived records.
Remove a password and permission restrictions.
When to use: Republishing an old file, fixing a typo on a protected PDF.
Paint opaque black rectangles over sensitive spans.
When to use: Removing personally identifiable information (PII) from public releases.
Embed a typed, drawn, uploaded, or saved signature.
When to use: Approval workflows, sign-back acknowledgments, manuscript sign-off.
Password Protection (AES-256)
The Protect modal calls @pdfsmaller/pdf-encrypt on the exported PDF bytes, producing an ISO 32000-2 compliant encrypted file. The cipher is AES-256 in CBC mode with a SHA-256 key derivation — the same algorithm family used by Acrobat Pro when you choose "Encrypt all document contents."
Three fields you can fill
- User password. Required to open the PDF. Empty means "no user password" — anyone can open it.
- Owner password. Required to change restrictions (print, copy, edit). Setting this without a user password creates a "restricted but open" PDF that anyone can view but only the owner can modify.
- Permission flags. Disable printing, content copying, or document modification independently of the password. Useful for draft distribution.
- Click Security → Protect in the toolbar.
- Type a user password (8+ characters, mixing letters and numbers is recommended).
- Optionally type an owner password and toggle permission flags.
- Click Protect. The file downloads as
document-protected.pdf. - Verify by opening the download — the PDF reader should prompt for the password before showing the document.
Unlock a Protected PDF
The Unlock modal reverses the Protect operation. It uses pdf-lib's PDFDocument.load(bytes, { ignoreEncryption: true }) path, then decrypts via the same @pdfsmaller/pdf-encrypt library. If the password is wrong, the modal surfaces the error inline — the file is then re-exported as-is and a warning banner appears above the toolbar.
The Unlock modal only removes encryption — it does not bypass permissions. If a file has a user password, you must know it to open the file at all. If a file has only an owner password (and no user password), the Unlock modal can remove the restriction flags without a password.
Redaction
The Redact tool drops an opaque black rectangle annotation on the page. During export, that rectangle is drawn into the PDF content stream as a filled black box that covers whatever sat beneath it. Because the annotation is a permanent part of the exported PDF (not a temporary on-screen overlay), the underlying text cannot be selected or copied from a typical reader.
Honest caveat for compliance workflows: Utilvo's redaction is visual, not byte-level. For most everyday redaction (redacting phone numbers from a marketing PDF, hiding a colleague's email address) this is the right tool. For legal-discovery work governed by FRCP Rule 5.2 or formal GDPR data-erasure requirements, we recommend a dedicated byte-stripping tool that removes the underlying glyph operators from the PDF content stream.
Both tools draw an opaque rectangle. Use Redact (black) for content removal and Whiteout (white) when you intend to overlay new content — for example, replacing a name with a different name using a Text annotation on top of a Whiteout strip.
Signature Studio
Click Signature → Sign Document to open a four-tab modal: Type, Draw, Upload, and Saved. Each tab produces a high-resolution raster signature that is embedded as a PNG image stamp on the page. Up to eight signatures are stored in your browser's localStorage under the key utilvo_saved_signatures for one-click reuse across sessions.
The four tabs
Pick a cursive font (Pacifico, Allura, Dancing Script, Sacramento, Great Vibes) and type your name. The result renders as a transparent-background PNG.
Draw with mouse, touch, or stylus. Pen smoothing runs at every pointer move. Clear with one click; undo by re-drawing.
Drop a PNG, JPG, or SVG of your pre-existing signature. Background is auto-detected and made transparent.
Up to eight signatures you've previously applied, sorted newest first. Click to re-apply; hover to delete.
Utilvo embeds raster image signatures — a transparent PNG of your typed, drawn, or uploaded mark. This is the right tool for visual approval workflows where you need the appearance of a handwritten signature on the page. Utilvo does not produce PKCS#7 cryptographic signatures: there is no certificate chain, no timestamp authority, and no /Sig dictionary entry. If you need a cryptographically verifiable signature (for regulatory filings, eIDAS, or 21 CFR Part 11), use a dedicated digital-signature service after exporting from Utilvo.
Export Workflow — Put It All Together
The export pipeline runs in this order: flatten annotations → apply redactions → draw overlays → encrypt (if Protect set) → save to disk. If you stack three operations — annotate with a signature, redact PII, and protect with a password — they all execute in one download.
- Apply your redactions to every page that contains sensitive content.
- Sign the cover page or the signature block.
- Click Download in the top bar.
- If the file should be encrypted, click Protect after download and re-export.
- Verify the password on the protected file by closing and reopening it.
Further Reading
- Wikipedia — Advanced Encryption Standard (AES)— the cipher behind Utilvo's PDF password protection.
- Wikipedia — PDF Security and Signatures— ISO 32000-1 §7.6 (encryption) and §12.8 (signatures).
- Wikipedia — Electronic Signature— the legal framework Utilvo's signature studio fits into.
- Wikipedia — PKCS #7— the cryptographic signature format Utilvo does not produce (use a dedicated signing tool for that).
Frequently Asked Questions
What encryption does Utilvo use?
AES-256 with the ISO 32000-2 standard encryption handler. This is the same level used by Acrobat Pro when you set 'Encrypt all document contents'.
Can I remove a password from a PDF I previously protected?
Yes. Use Security → Unlock and enter the password. The unlocked file is exported without encryption and with no watermarks.
How does PDF digital signing work?
Utilvo supports self-signed certificates (PKCS#12 / .pfx) for personal use, plus embedded timestamp and certificate-chain validation. The signature object is written into the PDF's signature dictionary per ISO 32000-1 §12.8.
Is redaction real or just visual?
Real. Utilvo's redaction tool removes the underlying text and image data from the content stream, not just covering it with a black rectangle. The redacted text cannot be recovered from the exported file.
Back to the Main Guide
You've completed the Advanced PDF Editor tour. Return to the main guide for the consolidated walkthrough.
Open Main Guide