How to protect a PDF with a username and password?

Question

I think this is a bit complicated and probably impossible, but it would be helpful to know if there is any way to do it...

Let's say I have a private teaching forum, where each user (paid account) has a username and an encrypted password, and there's a DOWNLOAD section where pdf files can be downloaded by users only.

Here's the question: When the file is downloaded, it will be protected by username and password/ password only that match with the username and password of the user himself... in other words, the password is taken from the user's account and added to the pdf file, then a download link is generated for that file.

This way, copying the pdf file to others would force the "copier" to give out his username and password...

EDIT: the password is for OPENING the file not editing or printing it, I want users to be able to highlight the text and add their own notes

Answer 1

You can't achieve what you want with PDF.

There are two ways to encrypt a PDF document:

1. Using passwords. You can define two passwords: a user password and an owner password. A document that is encrypted with an owner password can be opened by every one who receives the document. The owner password is there to define permissions (for instance: the document can be viewed, but not printed). Removing the restrictions without knowing the owner password is fairly easy. It used to be illegal when Adobe still owned the copyright on the PDF reference, but since PDF is now an ISO standard, it's not entirely clear if applying the spec to remove the owner password is allowed. If a document is encrypted using a user password, everybody who knows the user password can open the file. There is no username, only a user password.
2. Using certificates. You could ask your users to create a public/private key pair. You could then ask them to keep their private key private and ask them to give you their public key. When you encrypt your PDF using their public certificate, you can then encrypt the document with their public key. From that moment on, only the owner of the corresponding private key can read the document. However: the owner of the corresponding private key can also decrypt the document so that it can be shared.

Neither of both cases serve your purpose (read ISO-32000-1 for the full details). The only alternative is to buy an expensive DRM solution.