Cert Cryptor
Seal a PDF inside a CMS (.p7m) envelope encrypted to a recipient's certificate — only their private key opens it. Optional PKCS#7 signing.
Passwordless encryption for exactly who you mean
Certificate encryption vs passwords
Password protection has a built-in flaw: the password is a second secret you have to deliver safely, and anyone who gets it can open the file forever. Certificate encryption removes the shared secret entirely. You encrypt to the recipient's public certificate; only the matching private key — which never leaves their hands — can open the result.
This tool wraps your PDF in a CMS EnvelopedData package (.p7m): AES-256 encrypts the content, and the content key is wrapped separately for each recipient with RSA-OAEP. Add several recipient certificates and each holder can open the same sealed file independently.
Sign and seal in one pass
Optionally load your own PKCS#12 certificate to embed a real PKCS#7 signature before sealing — so the recipient can verify not just that the file is confidential, but that it came from you and hasn't been altered. A wax-seal stamp option draws a visible seal (signer name and date) on the last page for printed or previewed copies.
The seal is honest about what it is: a visual mark plus a real cryptographic signature underneath — not security theater.
How it protects the file
Standards-based cryptography, no shared secrets.
Recipient certificates
Import .cer/.crt/.pem public certificates. Each recipient's private key opens the same envelope.
AES-256 + RSA-OAEP
Content encrypted with AES-256-CBC; per-recipient key wrapping with RSA-OAEP — the CMS standard.
Optional PKCS#7 signature
Sign with your .pfx before sealing so authenticity travels with confidentiality.
No password to leak
Nothing to phone, email, or reuse — the recipient's existing private key is the only secret.
How recipients open it
The output is a .p7m file — the standard CMS envelope format. Recipients decrypt it with their private key using any CMS-compatible tool (openssl cms -decrypt, or their mail/PKI client). Because decryption needs the private key rather than a password, there is nothing for you to transmit separately and nothing for an attacker to phish.
Everything runs in your browser: the PDF, your .pfx, and the recipients' certificates never leave the device.
Cert Cryptor: Frequently Asked Questions
Common questions about this tool and how it works.
Free Forever
Pro
$29 one-timeRelated tools
Continue working with your PDFs
Sign PDF
Add electronic signatures to your PDF documents.
Protect PDF
Encrypt your PDF with a password.
Unprotect PDF
Remove password protection from your PDF.
Sanitize PDF
Strip metadata, annotations, scripts, and hidden data.
PDF Permissions
Set document restrictions like no-print or no-copy.
Redact PDF
Permanently remove sensitive content from your PDF.