# SecurityApi.protect()

```ts
protect(settings: ProtectionSettings): Promise<void>
```

Encrypts with passwords and permissions (AES-256). Permissions you do not mention stay allowed. An owner password equal to the open password protects nothing — a reader who holds the owner password can lift every restriction — so restricting anything needs an `ownerPassword` that differs from `userPassword`. Protecting a signed document changes what the signature covers, so it would no longer verify: refused as Acrobat refuses, unless `settings.invalidateSignatures`, and once told, the session asks no more. Needs the `export` feature.

- Kind: method
- Since: 1.0.0

| Parameter | Type | Description |
| --- | --- | --- |
| `settings` | `ProtectionSettings` | `userPassword` (required to open the document at all; leave empty for a document anyone can open but only the owner can change), `ownerPassword` (required to change permissions or remove protection), `permissions` (a `DocumentPermissions`, all optional) and `invalidateSignatures`. |

Returns `Promise<void>`

Throws:

- `INVALID_ARGUMENT` — no password at all, or restricting anything without an `ownerPassword` that differs from `userPassword`.
- `INVALID_STATE` — a signed document, unless `settings.invalidateSignatures`; or a progressive document still downloading.
- `FEATURE_NOT_LICENSED` — the license lacks `export`.
- `PAGE_ERROR` — the document could not be encrypted.
- `DOCUMENT_CLOSED` — the document has been closed.

```ts
// Anyone can open it; only the owner can print or change it
await doc.security.protect({
  ownerPassword: 'change-me',
  permissions: { print: false, modify: false },
});
```

Part of [SecurityApi](https://kernstra.com/docs/web-sdk/api/doc-security) in the Kernstra Web SDK 1.0.0 API reference.

Web page: https://kernstra.com/docs/web-sdk/api/doc-security/protect