What is certificate-based encryption?

Instead of a shared password, the file is encrypted to the recipient's public certificate. Only the holder of the matching private key can decrypt it — there is no password to share, guess, or leak.

What format is the output?

A CMS EnvelopedData file (.p7m) — the standard public-key envelope format. Recipients open it with their private key via openssl cms -decrypt or any CMS-compatible client.

Can I encrypt for more than one person?

Yes. Add multiple recipient certificates and the same sealed file can be opened by any of their private keys — each gets an independent key wrap.

What does the signing option add?

A real PKCS#7 signature inside the envelope, made with your .pfx certificate. Recipients can verify the sealed file came from you and was not altered. The optional wax-seal stamp adds a visible mark on the last page.

Is the seal just decoration?

The stamp is visual; the security is the embedded CMS signature and the envelope encryption. The stamp exists so printed or previewed copies still show the document was sealed.

Does anything leave my device?

No. Certificates, keys, and the document are processed entirely in the browser. There are no uploads and no network calls.

What if the recipient loses their private key?

The file cannot be recovered — that is the point of public-key encryption. Keep an unsealed copy or add a second recipient certificate you control as a backup.

تشفير PDF بشهادة المستلم: ختم بالمفتاح العام مجانًا

شفّر ملف PDF بشهادة X.509 الخاصة بالمستلم بحيث لا يفتحه إلا مفتاحه الخاص، دون كلمة مرور مشتركة. يدعم توقيع PKCS#7 اختياريًا داخل المتصفح.

1. Select PDF

Select a PDF file from your device. All cryptography runs locally.

2. Add recipient certificates

Import one or more public certificates (.cer/.crt/.pem) — each holder's private key can open the result.

3. Optionally sign

Load your .pfx to embed a real PKCS#7 signature and a wax-seal stamp.

4. Download

Get a sealed .p7m envelope only the recipients' private keys can open.

Passwordless encryption for exactly who you mean

Certificate encryption vs passwords

Password protection has a built-in flaw: the password is a second secret you have to deliver safely, and anyone who gets it can open the file forever. Certificate encryption removes the shared secret entirely. You encrypt to the recipient's public certificate; only the matching private key — which never leaves their hands — can open the result.

This tool wraps your PDF in a CMS EnvelopedData package (.p7m): AES-256 encrypts the content, and the content key is wrapped separately for each recipient with RSA-OAEP. Add several recipient certificates and each holder can open the same sealed file independently.

Sign and seal in one pass

Optionally load your own PKCS#12 certificate to embed a real PKCS#7 signature before sealing — so the recipient can verify not just that the file is confidential, but that it came from you and hasn't been altered. A wax-seal stamp option draws a visible seal (signer name and date) on the last page for printed or previewed copies.

The seal is honest about what it is: a visual mark plus a real cryptographic signature underneath — not security theater.

How it protects the file

Standards-based cryptography, no shared secrets.

Recipient certificates

Import .cer/.crt/.pem public certificates. Each recipient's private key opens the same envelope.

AES-256 + RSA-OAEP

Content encrypted with AES-256-CBC; per-recipient key wrapping with RSA-OAEP — the CMS standard.

Optional PKCS#7 signature

Sign with your .pfx before sealing so authenticity travels with confidentiality.

No password to leak

Nothing to phone, email, or reuse — the recipient's existing private key is the only secret.

How recipients open it

The output is a .p7m file — the standard CMS envelope format. Recipients decrypt it with their private key using any CMS-compatible tool (openssl cms -decrypt, or their mail/PKI client). Because decryption needs the private key rather than a password, there is nothing for you to transmit separately and nothing for an attacker to phish.

Everything runs in your browser: the PDF, your .pfx, and the recipients' certificates never leave the device.