Drop in a PDF you already have: it is sealed as it stands, without being converted again.
.pdf
Engine : PAdES + permissions (pyhanko) — Signature avancée et permissions restrictives disponibles.
With no certificate uploaded, mdseal signs with the server’s own. The key and its passphrase live in memory only, for the duration of the signature, and are never written to any log.
Encrypt (AES-256) and restrict
Once set, it becomes the only hard lock — but it locks OPENING, not use: the document no longer opens without it, in any reader, and whoever has it can then print and copy. Left empty, the document opens freely.
⚠ mdseal does not keep this password: lose it and the document is lost with it.
A ticked box means ALLOWED. That is what the PDF format means, and what any verifier will display: unticking “Printing” reads as print_highres: False.
Allowing high-resolution printing also allows plain printing: the format ignores the “high quality” bit when printing is refused.
Filling form fields stays allowed and is not in this list: sealing requires it, because a signature field is a form field. A PDF that already had fillable fields keeps them.
⚠ These restrictions are INSTRUCTIONS, never locks — with a password as without. Serious readers honour them; a tool that chooses to ignore them can, and the PDF format offers no way to stop it. The password protects access, never use: whoever has it can save a copy unencrypted and fully allowed. What is genuinely enforceable is the signature — see the help.