Where does the password go?

In "option". It must be at least four characters. It is used to encrypt and is never stored.

What does it stop someone doing?

Opening without the password, and, once open, copying text, editing, annotating and filling forms. High-resolution printing stays allowed.

Yes, with unlock-pdf and the same password. Without the password nobody can, which is the point.

Password protect PDF API

Encrypt with a password. Put the password in "option".

Get a free token Full API reference

Endpoint	POST https://astralpdf.com/api/v1/protect-pdf
Auth	Bearer token, free
Sends	input: base64
Returns	result: base64
Price	Free. 1,000 calls a day, 60 a minute.

When to call it

Documents that leave a system carrying personal or financial data should not travel in the clear: payslips, statements, medical letters. Encrypting in the job that generates them means it happens to every document, not to the ones somebody remembered.

For a one-off, the browser version needs no token and never sends your data anywhere: it runs on your own machine.

Example

curl

curl -X POST https://astralpdf.com/api/v1/protect-pdf \
  -H "Authorization: Bearer ast_YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"input": "JVBERi0xLjcKJYGBgYEK...", "option": "correct-horse-battery"}'

response

{
  "tool": "protect-pdf",
  "result": "JVBERi0xLjcKJWDjz9MKMSAwIG9iago8PC9UeXBlL0NhdGFsb2c...",
  "chars": 2640,
  "ms": 58
}

In your language

JavaScript

const res = await fetch("https://astralpdf.com/api/v1/protect-pdf", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ASTRAL_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"input": "JVBERi0xLjcKJYGBgYEK...", "option": "correct-horse-battery"}),
});
if (!res.ok) throw new Error((await res.json()).detail);
const { result } = await res.json();

Python

import os, requests

res = requests.post(
    "https://astralpdf.com/api/v1/protect-pdf",
    headers={"Authorization": f"Bearer {os.environ['ASTRAL_TOKEN']}"},
    json={"input": "JVBERi0xLjcKJYGBgYEK...", "option": "correct-horse-battery"},
    timeout=30,
)
res.raise_for_status()
result = res.json()["result"]

Parameters

Field	Type	Notes
input	string	Required. The file, base64 encoded. A data: URL is accepted too. Up to 6,000,000 characters per call.
option	string	See the example above.

Errors

Errors are RFC 7807 problem documents with a stable type you can branch on.

missing-token	401	No Authorization header.
bad-request	400	input missing or the wrong type.
tool-failed	422	The input could not be processed. detail says why.
quota-exceeded	429	Past 1,000 calls today.

Questions

Where does the password go?: In "option". It must be at least four characters. It is used to encrypt and is never stored.
What does it stop someone doing?: Opening without the password, and, once open, copying text, editing, annotating and filling forms. High-resolution printing stays allowed.
Can I undo it?: Yes, with unlock-pdf and the same password. Without the password nobody can, which is the point.

Other endpoints

A token takes thirty seconds

Free, no card, 1,000 calls a day, and the same token works on astraltext.com, astralpdf.com, astraljson.com and astralbatch.com.

Get a free token