How Long Does PDF Password Recovery Take? Complete Timeline Guide

The four variables that determine recovery time

Variable 1 — Encryption mode: PDF 40-bit RC4 files are always breakable, because the key space is only 2^40 and can be swept exhaustively. Mode 10500 covers 128-bit RC4 and AES-128 alike and runs at ~166 million candidates/second. Mode 10600 is Acrobat 9 AES-256 (revision 5) at ~28,500 million candidates/second — the fastest password mode, because its derivation is a single SHA-256. Mode 10700, AES-256 with the revision-6 derivation, is the slowest of all at ~595,000 candidates/second.

Variable 2 — Password length and character set: the candidate space is charset_size^length. A 6-character lowercase password (26^6 = 308M candidates) tests in minutes on any GPU. A 10-character full-ASCII password (95^10 = 59.9 quintillion) takes centuries even on large clusters.

Variable 3 — Pattern predictability: most forgotten PDF passwords are human-chosen, not random. For human-chosen passwords the dictionary and rule stage usually succeeds quickly, because it tests common patterns first. Brute-force timelines only apply to truly random passwords, which are rare in practice.

Variable 4 — GPU cluster size: a single RTX 5090 is the baseline. Professional services use 8-32 GPUs, dividing the timeline by (GPU count × 0.94) — a flat 6% combined scaling loss, which is a rule-of-thumb assumption rather than a measured figure at 32 GPUs.

40-bit RC4 (modes 10400/10410/10420) — always breakable

Forty-bit RC4 files are unique: the key is exactly 40 bits, so every possible key can be tested exhaustively. That key-space search is what hashcat's collider modes 10410 and 10420 implement; mode 10400 is the plain password-search mode for the same files, and a five-byte mask under it covers the same 2^40 candidates. Either way, password length, complexity and character set are irrelevant to getting the document open.

Timeline on a single RTX 5090: about four minutes for a full 2^40 sweep at mode 10400's measured ~5.0 GH/s, and less with the collider modes. What that yields is a working key — access to the document — not necessarily the original password string.

Multi-GPU scaling: about 30 seconds on eight GPUs, a few seconds on a 32-GPU cluster.

CPU-only timeline: a CPU can still finish the sweep, but expect hours rather than minutes — a GPU is what makes 40-bit recovery a coffee break. This is also the only tier where exhaustive key-space search is practical without a GPU; for modes 10500-10700 a CPU is only usable for bounded dictionary and rule attacks.

Mode 10500 (RC4-128 and AES-128) — fast GPU throughput

Mode 10500 covers 128-bit RC4 and AES-128 files alike, because the password check is the same 50-iteration MD5 derivation in both. It runs at approximately 166 million candidates per second on a single RTX 5090, and its cost is dominated by that MD5 loop rather than by the cipher.

Dictionary+rule attack (10M wordlist, 50 rules = 500M candidates): about 3 seconds on a single GPU, under a second on eight. This is the most likely successful attack for human-chosen passwords.

Brute-force mask attack timelines for mode 10500 on a single GPU: 6-char lowercase (308M candidates) = about 2 seconds. 8-char lowercase (208B) = about 21 minutes. 8-char alphanumeric (2.82T) = about 4.7 hours. 10-char lowercase (141T) = about 10 days.

Mode 10500 PDFs date from the 2001-2010 era, with AES-128 files continuing into the mid-2010s. Passwords from that period were typically shorter and simpler than modern ones, and a bounded dictionary and rule pass against them is over in seconds.

Mode 10600 (Acrobat 9 AES-256, revision 5) — the fastest password mode

Mode 10600 is not AES-128: it is PDF 1.7 ExtensionLevel 3 (Acrobat 9, 2008) AES-256 at revision 5, whose key derivation is a single SHA-256 with no iteration. That makes it the fastest PDF password mode after 10400 — approximately 28,500 million candidates per second on an RTX 5090.

Dictionary+rule attack (500M candidates): effectively instant on a single GPU, so the dictionary phase is free. Most human-chosen passwords from the Acrobat 9 era (2008-2010) fall to it.

Brute-force mask attack timelines for mode 10600 on a single GPU: 6-char lowercase (308M) = about 0.01 seconds. 7-char lowercase (8B) = about 0.3 seconds. 8-char lowercase (208B) = about 7 seconds. 8-char alphanumeric (2.82T) = about 99 seconds.

Eight-GPU cluster timelines for mode 10600: 8-char lowercase = about a second. 8-char alphanumeric = about 13 seconds. 10-char lowercase = about 11 minutes. The practical boundary for this revision sits far out — it takes random passwords of 11-12 characters in a wide charset to stop it, not short ones.

Mode 10700 (AES-256, revision 6) — slowest per-candidate rate

Mode 10700 is AES-256 with the revision-6 key derivation (Algorithm 2.B: a minimum of 64 rounds, each combining an AES-128-CBC pass with one SHA-256, SHA-384 or SHA-512 round). It runs at approximately 595,000 candidates per second on a single RTX 5090 — the slowest PDF mode by some four orders of magnitude, because of that iterated derivation.

Dictionary+rule attack (500M candidates): about 14 minutes on a single GPU, about 2 minutes on eight, under a minute on 32. The dictionary phase is always fast because the candidate count is bounded by the wordlist size, not by brute-force combinatorics.

Brute-force mask attack timelines for mode 10700 (~595 kH/s) on a single GPU: 6-char lowercase = about 8.5 minutes. 7-char lowercase = about 3.8 hours. 8-char lowercase = about 4 days. 8-char alphanumeric = about 55 days. 10-char lowercase = about 7.5 years.

Eight-GPU cluster timelines for mode 10700: 8-char lowercase = about 13 hours. 8-char alphanumeric = about 7 days. 9-char lowercase = about 14 days. 10-char lowercase = about 1 year. The practical boundary is around 10-12 characters, depending on the character set.

Real-world timelines — how long it actually takes

In practice, most PDF password recovery cases complete much faster than the brute-force worst-case estimates. This is because real-world passwords follow patterns, and pattern-based attacks are tested first.

Fast case: a user-chosen password with common patterns is usually found by a bounded dictionary/rule search, often within minutes. There is no universal success percentage for this — it depends on the corpus and the search budget, which is why timelines are given as ranges rather than as a rate.

Moderate case: password known partially (e.g., 'starts with my dog's name, ends with a year'). Mask attack with known constraints reduces search space by 90-99%. Timeline: 1-7 days on a professional cluster.

Difficult case: password is a moderate-length random string (8-10 characters) with no known pattern. Requires brute-force or combinator attack. Timeline: 30-90 days on a professional multi-GPU cluster. Cost may exceed document value.

Infeasible case: strong random password (12+ characters, full charset) from a password manager. Timeline: centuries. No practical recovery possible. The document must be accepted as permanently lost or replaced from source.

How to get a precise estimate for your PDF

The most reliable way to get a realistic timeline is to run a free analysis with a professional recovery service. The analysis identifies the encryption tier — the /V and /R values and the crypt filter method, which is what the file actually records — runs fast dictionary attacks to test common patterns, and provides a timeline estimate based on the actual encryption parameters and your partial password recall.

If you want to estimate yourself: (1) identify the mode with qpdf --show-encryption (plus qpdf --json for V and the key length) or the browser-based tool, (2) estimate password characteristics (length range, character types, any known patterns), (3) calculate candidate space (charset_size^length for brute-force, or wordlist_size x rules for dictionary), (4) divide by your GPU throughput (single RTX 5090: ~595 kH/s for mode 10700, ~28.5 GH/s for 10600, ~166 MH/s for 10500; multiply by GPU count x 0.94).

Remember that dictionary attacks always run first and catch the majority of cases. The brute-force timeline is the worst case and applies only if dictionary and rule attacks fail. Most users never reach the brute-force stage because their password is found in the dictionary phase.

Estimating your PDF recovery timeline

1. 1

   Identify the encryption mode

   Use the browser-based PDF encryption info tool, or qpdf --show-encryption for R and the encryption method plus qpdf --json for V and the key length. This sets the per-second password test rate.

2. 2

   Recall what you can about the password

   Length estimate, character types (digits only, lowercase only, mixed), any known substrings or themes. This determines the search space.

3. 3

   Calculate or estimate the candidate space

   charset^length for brute-force. For dictionary: wordlist entries x rule count (typically 10M x 50 = 500M). For mask: constrained positional charset.

4. 4

   Divide by effective GPU speed

   Mode 10700: ~595 kH/s per GPU x GPU count x 0.94. Mode 10600: ~28.5 GH/s per GPU. Mode 10500: ~166 MH/s per GPU. 40-bit RC4: minutes regardless of password.

5. 5

   Run the free analysis for the real answer

   The free analysis phase gives you a data-driven timeline using the service's actual GPU cluster, tested against your specific encryption parameters.

Frequently Asked Questions

Related Reading