askvity

How do I make a PDF link in HTML non-downloadable?

Published in PDF Security 4 mins read

It's impossible to completely prevent a user from downloading a PDF linked in HTML if they can view it in their browser. However, you can make it less straightforward and discourage casual downloading. Here's a breakdown of approaches and why they work (or don't):

Why "Non-Downloadable" is a Misnomer

Any content displayed in a browser must be downloaded to the user's device temporarily. The browser needs the data to render the PDF. What you're really trying to do is prevent easy or obvious methods of saving the file.

Strategies and their Limitations:

  1. Embedding the PDF with <embed> or <iframe> and Hiding the Toolbar:

    This is a common approach, but it's not foolproof.

    <embed src="path/to/your/document.pdf#toolbar=0&navpanes=0&scrollbar=0" type="application/pdf" width="800" height="600">

<!-- OR -->

<iframe src="path/to/your/document.pdf#toolbar=0&navpanes=0&scrollbar=0" width="800" height="600"></iframe>
    • src="path/to/your/document.pdf": Specifies the path to your PDF file. Replace "path/to/your/document.pdf" with the actual URL.
    • #toolbar=0: Attempts to hide the PDF viewer's toolbar, which often includes download and print buttons.
    • #navpanes=0: Attempts to hide the navigation panes.
    • #scrollbar=0: Attempts to hide the scrollbar.
    • type="application/pdf": Specifies the MIME type.
    • width and height: Set the dimensions of the embedded PDF.

    Limitations:

    • Browser Variations: Toolbar hiding is not consistently supported across all browsers and PDF viewers. Some viewers might ignore these parameters.
    • Right-Click Save: Users can often right-click within the embedded PDF and choose "Save As..." or a similar option to download the file.
    • Developer Tools: Technically savvy users can always access the PDF URL from the browser's developer tools (Network tab) and download it directly.

  2. Using JavaScript to Disable Right-Click (Highly Discouraged):

    You can use JavaScript to try to disable the right-click context menu, but this is considered poor user experience and is easily bypassed. It won't prevent determined users from downloading the PDF.

  3. PDF Security Settings (Limited Control):

    You can set security options within the PDF itself (using PDF editing software) to disable printing and editing. However:

    • This doesn't prevent downloading.
    • It relies on the PDF viewer respecting these settings (which isn't guaranteed).
    • Users can often bypass these restrictions with readily available PDF unlocking tools.

  4. Watermarking:

    While it doesn't prevent downloading, adding a visible watermark to each page of the PDF makes it less useful for unauthorized distribution.

  5. Server-Side Protection (More Robust, but Complex):

    • Restricting Access: Implement server-side authentication and authorization. Only allow logged-in users with specific permissions to access the PDF.
    • Dynamically Generating PDFs: Generate PDFs on the fly from a database or other data source. This makes it harder for users to simply download a static file.
    • Streaming the PDF: Instead of serving the PDF as a static file, stream it to the client. This is more complex and requires server-side scripting, but can make it harder to download.
    • Rendering the PDF on the Server: Convert the PDF to images on the server and display those images in the browser. This prevents the user from downloading the actual PDF file.

The Most Realistic Approach

The best approach is a combination of methods:

  1. Embed the PDF with the toolbar hidden (using <embed> or <iframe> with #toolbar=0). This discourages casual downloading.
  2. Consider watermarking the PDF.
  3. Implement server-side access control if security is paramount. This is the only way to significantly limit access.

In Conclusion

You cannot make a PDF completely non-downloadable if it's displayed in a browser. You can only make it more difficult to download, discouraging casual users. For true security, focus on server-side controls and consider alternatives to PDF delivery if preventing downloads is critical.

Related Articles