PDF X.509 ：，

Certificate encryption vs passwords

Password protection has a built-in flaw: the password is a second secret you have to deliver safely, and anyone who gets it can open the file forever. Certificate encryption removes the shared secret entirely. You encrypt to the recipient's public certificate; only the matching private key — which never leaves their hands — can open the result.

This tool wraps your PDF in a CMS EnvelopedData package (.p7m): AES-256 encrypts the content, and the content key is wrapped separately for each recipient with RSA-OAEP. Add several recipient certificates and each holder can open the same sealed file independently.

Sign and seal in one pass

Optionally load your own PKCS#12 certificate to embed a real PKCS#7 signature before sealing — so the recipient can verify not just that the file is confidential, but that it came from you and hasn't been altered. A wax-seal stamp option draws a visible seal (signer name and date) on the last page for printed or previewed copies.

The seal is honest about what it is: a visual mark plus a real cryptographic signature underneath — not security theater.

How it protects the file

Standards-based cryptography, no shared secrets.

How recipients open it

The output is a .p7m file — the standard CMS envelope format. Recipients decrypt it with their private key using any CMS-compatible tool (openssl cms -decrypt, or their mail/PKI client). Because decryption needs the private key rather than a password, there is nothing for you to transmit separately and nothing for an attacker to phish.

Everything runs in your browser: the PDF, your .pfx, and the recipients' certificates never leave the device.