PL/ENCRYPT — AES-256 PDF Encryption for Oracle
Protect existing PDF documents stored as Oracle BLOBs with AES-256 encryption, passwords and document permissions directly from PL/SQL. PL/ENCRYPT works with PDFs generated by PL/PDF or by any other PDF-producing application.
Protect PDFs where your Oracle data already lives
PL/ENCRYPT is designed for Oracle applications that already create, receive or store PDF documents as BLOBs. It adds password-based AES-256 protection without requiring a separate PDF security service or external processing server.
AES-256 protection
PL/ENCRYPT uses the PDF Standard Security Handler with AES-256 encryption, Revision 6 and AESV3 crypt filters.
Oracle BLOB in, BLOB out
Pass an existing unencrypted PDF as a BLOB and receive a new encrypted PDF BLOB. The original source BLOB remains unchanged.
Generator-independent
Protect PDFs created by PL/PDF, APEX reporting tools, external reporting systems or other PDF software. PL/ENCRYPT operates on the PDF itself.
One PL/SQL function
The public PL/ENCRYPT API is intentionally small. One function applies AES-256 protection, passwords and permissions to an existing PDF.
l_encrypted_pdf := pl_encrypt.setProtection(
p_pdf => l_source_pdf,
p_print_perm => true,
p_modify_perm => false,
p_copy_perm => false,
p_annot_forms_perm => false,
p_user_pass => 'user',
p_owner_pass => 'owner'
);The returned value is a new temporary BLOB containing the encrypted PDF. Transaction control remains entirely under the calling application’s control.
Control how the PDF can be used
PDF encryption can protect document access while also defining operations that compliant PDF readers should allow for users who open the protected document.
Printing
Control whether compliant PDF readers allow the protected document to be printed.
Modification
Control whether users may modify the document after opening it.
Copying
Control copying and content extraction from the encrypted PDF.
Annotations and forms
Control annotation and form-related operations in compliant PDF readers.
Secure by default: all four permission flags default to FALSE. Enable only the operations required by your document workflow.
User and owner passwords
User password
The user password controls normal document access. When it is NULL, the PDF can normally be opened without a password prompt while the configured permission restrictions still apply.
Owner password
The owner password provides owner-level access in compliant readers. If no owner password is supplied, PL/ENCRYPT generates a random owner secret internally.
PL/ENCRYPT uses PDF Revision 6 password preparation with UTF-8 processing. Strong, distinct user and owner passwords are recommended because password quality remains an important part of effective PDF security.
Modern PDF encryption without changing your generation workflow
PL/ENCRYPT is independent from PDF generation. Applications can continue using their existing reporting and document-generation tools, then pass the finished PDF BLOB to PL/ENCRYPT as a separate security step.
1. Generate or receive the PDF
Create the document with PL/PDF, another Oracle reporting tool or an external system, and store or receive it as a BLOB.
2. Apply protection
Call PL_ENCRYPT.SETPROTECTION with the required passwords and permission settings.
3. Store or deliver
Persist the resulting encrypted BLOB, return it from an application or deliver it through the existing document workflow.
Encryption protects confidentiality
PL/ENCRYPT protects PDF content against unauthorized access. It does not establish authorship or document integrity in the way a digital signature does.
If your workflow also requires PAdES digital signatures, trusted timestamps or long-term validation, explore PL/SIGN.
Predictable PDF processing
PL/ENCRYPT performs a controlled full rewrite of the source PDF and creates a separate encrypted output document.
Supported processing
- AES-256 PDF encryption
- User and owner passwords
- Printing permissions
- Modification permissions
- Copy and content-extraction permissions
- Annotation and form permissions
- Classic cross-reference tables
- Cross-reference streams
- Object streams
- Hybrid-reference PDFs
Current restrictions
- Input PDF must be unencrypted
- Already encrypted PDFs are rejected
- Digitally signed PDFs are rejected
- Full rewrite rather than incremental update
- AES-256 only — no RC4 or AES-128 selection
Signed PDFs are deliberately rejected because rewriting the document would invalidate existing byte-range signatures.
PDF encryption for real Oracle workflows
Use PL/ENCRYPT wherever an Oracle application needs to protect an existing PDF before storage, download or delivery.
Invoices and statements
Protect financial documents before they leave the Oracle application.
HR and customer documents
Add password protection to PDFs containing personal, confidential or customer-specific information.
Secure document delivery
Encrypt generated or received PDFs before download, email delivery or transfer to another system.
Try PL/ENCRYPT
Request access to a hosted sandbox, or evaluate PL/ENCRYPT in your own Oracle environment with an install kit and a 31-day evaluation key.