How To Open a Password Protected PDF Without the Password

Step 1 — Find out what encryption type the PDF uses

Before any method can be applied, you need to know the encryption tier. Open the PDF in a text editor (Notepad, VS Code) and look for the `/Encrypt` dictionary near the end of the file, or use `qpdf --show-encryption file.pdf` if you have qpdf installed. The fields V, R, and Length identify the encryption generation.

V=1 R=2 Length=40 means PDF 1.1-1.3 40-bit RC4 (Hashcat mode 10400) — this is the best-case scenario. V=2 R=3 Length=128 means PDF 1.4-1.6 128-bit RC4 (mode 10500). V=4 R=4 means AES-128 (mode 10600). V=5 R=6 means AES-256 (mode 10700). Each tier has a different recovery probability.

If you cannot or prefer not to install software, use the browser-based PDF encryption info tool (tools/pdf-encryption-info) which reads the encryption dictionary without uploading the file. This is the fastest way to identify the encryption tier.

Method 1 — Professional password recovery (highest success rate)

Professional PDF password recovery services use hashcat on multi-GPU clusters to test millions of candidate passwords per second. They extract the encryption hash from your PDF and run dictionary attacks, rule-based mutations, mask attacks, and brute-force key search depending on the encryption mode.

For mode 10400 (40-bit RC4), professional recovery is mathematically guaranteed. The entire 2^40 key space can be searched in about 60-90 minutes on a single RTX 5090 GPU, regardless of what password was set. For modes 10500-10700, success depends on whether the password is weak enough to find within the search space.

The best services operate on a pay-on-success model: you pay only if the password is found. The free analysis phase tests the most common password patterns and dictionary entries before any payment commitment. If the free phase finds the password, the cost is typically low; if it does not, you can decide whether to proceed based on the realistic timeline estimate.

Method 2 — Chrome Print-to-PDF trick (limited cases)

The Chrome Print-to-PDF trick works on SOME password-protected PDFs: open the PDF in Google Chrome, go to File > Print (or Ctrl+P), select 'Save as PDF' as the destination, and save the output. Chrome sometimes decrypts the PDF for rendering purposes and re-encrypts (or does not) during the print-to-PDF process.

This method ONLY works on PDFs with owner-password protection (restrictions on printing/editing, but the document opens without a password). It does NOT work on PDFs with file-open password encryption — Chrome cannot render content it cannot decrypt, so the print output is blank or an error page.

To test: try opening the PDF in Chrome. If it opens and shows content without asking for a password, the Print-to-PDF trick may work for removing owner restrictions. If Chrome asks for a password to open, the trick will not help — Chrome does not have the password either. See the dedicated guide on Chrome Print-to-PDF for detailed instructions.

Method 3 — Online unlock tools (require the password)

Online PDF unlock websites (Smallpdf, iLovePDF, PDF2Go) advertise that they can unlock PDFs. What they actually do: they accept the PDF and a password that YOU enter, then decrypt the file using that password. They do NOT crack passwords. They are browser-based decryptors, not password recovery tools.

If you do not know the password, online unlock tools will not help. The upload form has a password field for a reason — the tool needs the password to decrypt. Without it, the server cannot open the file either.

Online tools CAN help in one specific scenario: if the PDF has only owner-password protection (opens without a password but restricts printing/editing). In that case, the tool can strip the owner permission flags without needing a password because the content is not encrypted. For genuine file-open encryption, online tools provide zero benefit.

Method 4 — Adobe Acrobat 'Remove Password' (requires the password)

Adobe Acrobat Pro has a 'Remove Password' feature under File > Properties > Security > Change Settings > No Security. This feature decrypts the PDF and saves an unprotected copy. However, it requires you to ENTER the current password. If you do not know the password, the Remove Security button is greyed out.

Many users believe Acrobat can recover forgotten passwords. It cannot. Adobe explicitly documents that Acrobat cannot crack or recover passwords. The Remove Password feature is designed for users who know the password and want to strip it permanently from the file.

If you have Acrobat Pro and know the password, this is the fastest way to remove protection. If you do not know the password, skip this method and go straight to professional recovery.

Method 5 — Hashcat self-service (requires technical skill)

Hashcat is the industry-standard password recovery tool. It is free and open-source, supporting PDF modes 10400-10700. If you have a compatible GPU (NVIDIA or AMD with sufficient VRAM) and technical knowledge, you can run hashcat yourself.

The workflow: extract the PDF hash with pdf2john.pl (from John the Ripper) or pdf2hashcat (from hashcat-utils), identify the hash mode (10400-10700), and run hashcat with a dictionary attack: `hashcat -m 10700 hash.txt rockyou.txt -r best64.rule`.

Self-service advantages: no file upload, full control over attack parameters, no per-file fees. Disadvantages: you need a GPU ($1,000-$2,000 for a mid-range card), hashcat experience, and time. Mode 10700 with a moderately complex password can run for weeks on a single GPU.

When none of these methods work

If the PDF uses AES-256 (mode 10700) with a strong random password generated by a password manager — 12+ characters, full charset — no method on this list can open it. The password must be known. If you remember nothing about the password and the encryption is modern AES, the honest answer is that the document is unrecoverable.

In this situation, your remaining options are: contact the document author or sender to request the password, check password managers, browser autofill, email archives, or sticky notes for a saved copy, or regenerate the document from the original source if possible. Some organisations re-issue documents on request (tax authorities, government agencies).

For future documents: save passwords in a password manager (Bitwarden, 1Password, KeePass) at creation time. A password manager removes the single point of failure — you only need to remember the master password, and all PDF passwords are stored securely.

How to open a password-protected PDF without the password

1. 1

   Identify the encryption tier

   Use the browser-based PDF encryption info tool or qpdf --show-encryption to determine V/R/Length values. This tells you whether recovery is feasible.

2. 2

   Check for owner protection only

   If the PDF opens without a password but restricts printing/editing, use any online unlock tool or qpdf --decrypt without a password. No cracking needed.

3. 3

   For file-open encryption, run free analysis

   Submit to a professional recovery service. The free analysis tests common patterns and reports the encryption tier with a realistic success probability.

4. 4

   For mode 10400 (40-bit RC4)

   Professional recovery is guaranteed. Proceed with confidence — the 2^40 key space can be searched in 60-90 minutes regardless of password.

5. 5

   For modes 10500-10700

   If the free analysis succeeds, proceed. If it does not and you remember nothing about the password, evaluate whether the document value justifies the GPU time needed.

Frequently Asked Questions

Related Reading