PDF Certificate Security

Password encryption uses a shared secret that multiple people must know. Certificate encryption uses public-key cryptography: anyone can encrypt with the recipient's public key, but only the recipient's private key can decrypt it. No shared password needed.

X.509 is a standard format for public-key certificates issued by Certificate Authorities. Email certificates (S/MIME), code-signing certificates, and TLS/HTTPS certificates are all X.509. The recipient's public key is used to encrypt the PDF.

Recipients can export their certificate from their email client (Outlook, Thunderbird), from their organisation's directory, or from a public certificate repository.

Yes. Encrypt the PDF with each recipient's public key separately. Each recipient can decrypt with their own private key.

Both can use AES-256 for the actual content encryption. The advantage of certificate-based security is eliminating the shared password risk — there is no password to share, intercept, or forget.

Yes. All encryption runs in your browser. Your PDF and recipient certificates are never uploaded to any server.