Pro plan

Watermarking

Stamp each reader's identity and timestamp on the pages they view and download.

Watermarking adds a visible mark to every page a reader is served, displaying an identity for that reader and the UTC timestamp of access. It is a deterrent against redistribution: the mark travels on the copy, so a forwarded file carries it. It is not an access control and it records nothing — EveryPage does not store the text it stamped, so the mark is evidence on a recovered copy, not an audit log you can query.

Watermarking is a Pro feature. If the file owner's plan drops below Pro, the watermark stops being applied to new requests.

How watermarking works

When watermarking is enabled on a file, every non-owner request is marked. For files up to the size cap below, the mark is stamped into the PDF itself server-side — for inline viewing in the browser and for explicit downloads alike, so the bytes that reach the reader already carry it. The owner never sees a watermark on their own views or downloads, regardless of the setting.

The watermark text follows a three-tier identity precedence:

  1. Invited via email — If the viewer accessed the file through an email invite link, the watermark displays their invited email address.
  2. Captured by a gate — If the viewer entered an email address to pass an email gate or lead-capture form, that captured address appears on the watermark.
  3. Pseudonymous viewer key — If neither applies (anonymous viewing), the watermark shows Viewer a1b2c3: the first six characters of a random per-viewer key minted for that browser session. It is opaque, and it is not derived from the reader's IP address or any other identifier. It is stable only for as long as that browser session lasts — a reader who clears cookies, uses a private window, or opens the link on another device is marked as a different viewer.

Every watermark includes a UTC timestamp (2026-08-06 14:30 UTC).

Downloaded files carry the watermark

Downloads are stamped into the PDF server-side using pdfcpu before the bytes leave EveryPage's servers, so the saved file on the viewer's computer carries the mark rather than relying on anything the browser draws.

The mark lives in the page content stream, so it survives forwarding, re-saving, and printing to PDF. It does not prevent copying, and it is not tamper-proof: anyone willing to edit the PDF or re-render its pages can remove or obscure it.

Size limit for stamped output

Because server-side stamping requires decrypting and rewriting the entire PDF, large files incur a significant processing cost. Watermarking combined with download permission is refused for files larger than 100 MB. If you try to enable both watermark and download permission on a file over this threshold, the settings form rejects the change until one of the two is disabled; a file that somehow already carries that combination refuses the download instead of serving unstamped bytes.

Above the cap, inline viewing is still allowed but the mark is no longer stamped into the bytes — the viewer draws it over the pages in the browser instead. That overlay is cosmetic: a reader can remove it with browser developer tools, and it is absent from any copy of the file taken outside the viewer. Treat watermarking on files over 100 MB as a visual deterrent only.

Appearance options

You control how prominent the watermark appears to viewers:

Opacity

The opacity slider ranges from 0.05 to 0.5 (barely visible to moderately opaque). The default is 0.12, which is subtle enough not to obstruct reading but visible enough to serve as a deterrent.

Any value below 0.12 applies to the browser overlay only. Every stamped PDF — inline view or download — is floored back to 0.12 before stamping, because a setting that is legible as crisp CSS text can be invisible once rasterized on a small screen. The effective range for stamped output is therefore 0.12 to 0.5.

Density

For stamped PDFs, density controls how many instances of the watermark are placed on each page:

  • Sparse — One instance: a large diagonal across the center of the page
  • Normal (default) — Three instances: the center diagonal, plus smaller marks near the top-left and bottom-right
  • Dense — Five instances: the center diagonal plus all four corners

In the browser overlay (used above the size cap), the same setting changes how tightly the mark is tiled rather than how many fixed instances are drawn.

Combining watermarking with page ranges

If a file has both a page-range limit and watermarking enabled, both transforms apply in a single server pass. The page range is trimmed first, then the watermark is stamped onto the trimmed pages. The two failure modes are deliberately different: a trim failure always fails the request, while a stamp failure on an inline view falls back to serving the already-trimmed file unstamped. Pages outside the range are never served either way.

On an explicit download, a stamp failure fails the request rather than handing over an unstamped copy.