Password Analysis

PDF Password Length vs Crack Time — Complete Analysis

The single most important factor determining whether a forgotten PDF password can be recovered is its length — but the relationship between length and crack time is not linear; it's exponential. Each additional character multiplies the candidate space by the character-set size. Combined with the encryption mode's per-password verification speed, this determines whether recovery is feasible in a practical timeframe. This article gives per-mode crack times for every encryption mode and password length, derived from hashcat's published RTX 5090 benchmark rates.

The exponential math behind password length

The candidate password space for a brute-force attack on a PDF password is charset_size^length. For lowercase (26): 26^6 = 308 million, 26^8 = 208 billion, 26^10 = 141 trillion. For mixed-case alphanumeric+symbols (95 printable ASCII): 95^6 = 735 billion, 95^8 = 6.6 quadrillion, 95^10 = 59.9 quintillion.

This exponential growth means that increasing password length by even one character dramatically increases the crack time. A 6-character password may fall in minutes; an 8-character one of the same type may take days to centuries, depending on the encryption mode — the same two-character increase multiplies the search space by 95^2 = 9,025x.

In practice, password recovery uses three strategies that avoid searching the full brute-force space: dictionary attacks (testing real words and patterns), rule-based mutation (adding digits, capitalizing, substituting), and mask attacks (constraining character positions by type). These reduce effective search space by orders of magnitude for human-chosen passwords.

The '6 vs 8' gap

A 6-character password falls quickly on any modern GPU — seconds to minutes, depending on the mode. An 8-character password of the same type can take days, or years on the slowest mode. The jump from 6 to 8 adds only 2 characters but multiplies the search space by 676x (lowercase) to 9,025x (95-character set). This is why password length is the single most important security parameter.

Mode 10400 (40-bit RC4) — the 40-bit key space

Mode 10400 (40-bit RC4, PDF 1.1-1.3) is the weakest PDF tier. The file key is only 40 bits: the password is hashed with MD5 and the digest truncated to five bytes, so the number of distinct keys is capped at 2^40. Two different attacks follow from that. hashcat's mode 10400 searches candidate passwords, so length and charset do affect it. A direct key-space search over the 2^40 keys is length-independent and needs different tooling; in hashcat it is exposed through the collider modes 10410 and 10420.

On a single RTX 5090, hashcat's published benchmark puts mode 10400 at about 5.0 billion candidates per second, so a full 2^40 sweep is roughly four minutes of GPU time. What that yields is a working key — access to the document — not necessarily the original password string.

For the key-recovery path, password length is irrelevant: any padded password whose MD5 truncation matches yields the same key. A password search of the same mode is not length-independent. Either way, mode 10400 is the tier where access to the document is reliably recoverable.

Mode 10500 and 10600 (128-bit RC4 / AES-128, and Acrobat 9 AES-256) crack times

Mode 10500 covers both 128-bit RC4 (V=2/R=3) and AES-128 (V=4/R=4) files: hashcat parses both under the same mode, because the password check is the same 50-iteration MD5 derivation. Measured on an RTX 5090 it runs at about 166 million candidates per second. That is a password search, not a key search, and a 500M-candidate dictionary+rule pass takes about three seconds.

Mode 10600 is not AES-128: it is PDF 1.7 ExtensionLevel 3 (Acrobat 9, 2008) AES-256 at revision 5, whose key derivation is a single SHA-256. That makes it the fastest PDF password mode after 10400 — about 28,500 million candidates per second on an RTX 5090.

Brute-force mask attack times for mode 10600 (~28,500 MH/s) by length and charset:

6-char lowercase (26^6 = 308M): about 0.01 seconds. Instant.

8-char lowercase (26^8 = 208B): about 7 seconds. Instant.

8-char alphanumeric (36^8 = 2.82T): about 99 seconds.

10-char lowercase (26^10 = 141T): about 1.4 hours. Not a barrier.

8-char full printable ASCII (95^8 = 6.6Q): about 2.7 days. Feasible on a cluster.

Mode 10700 (AES-256, revision 6) crack times — the modern standard

Mode 10700 is AES-256 at revision 6 — the construction introduced with PDF 1.7 ExtensionLevel 8 (Acrobat X, 2010) and retained unchanged by PDF 2.0. Its key derivation is Algorithm 2.B, which runs a minimum of 64 rounds (roughly 70 typical), each combining an AES-128-CBC pass over a repeated buffer with one SHA-256, SHA-384 or SHA-512 round chosen per round. That makes it by far the slowest PDF mode per candidate: measured at about 595,000 candidates per second on an RTX 5090, some four orders of magnitude below the revision-5 mode.

Dictionary+rule attack (10M words, 50 rules, 500M candidates) at ~595 kH/s: about 14 minutes. Practical for human-chosen passwords.

Brute-force mask attack times for mode 10700 (~595 kH/s) by length and charset:

6-char lowercase (308M): about 8.5 minutes.

7-char lowercase (8B): about 3.8 hours.

8-char lowercase (208B): about 4 days on one GPU; hours on a large cluster.

8-char alphanumeric (2.82T): about 55 days on one GPU; about 7 days on eight.

10-char lowercase (141T): about 7.5 years on one GPU. Out of reach on realistic clusters unless the password is human-chosen.

Multi-GPU cluster scaling effects

The crack times above are for a single RTX 5090. A professional recovery service with 8 GPUs reduces all times by approximately 7.5x (accounting for 8-GPU scaling overhead).

With 8 × RTX 5090 on mode 10700: 8-char lowercase drops from about 4 days to roughly 13 hours. 8-char alphanumeric drops from 55 days to about 7 days.

With a 32-GPU cluster (four 8-GPU systems) the rate is about 4x the 8-GPU figure: roughly 17.9 MH/s on mode 10700. 8-char lowercase drops to about 3.2 hours, and 8-char alphanumeric to about 1.8 days — costly but potentially worth it for high-value documents.

The practical ceiling: under mode 10700, 10-character lowercase is borderline — roughly three months on a 32-GPU cluster — and the infeasible boundary sits around 11-12 characters of a wider charset (36^11 or 95^10). That is the boundary between recoverable and unrecoverable for mode 10700 PDFs.

Dictionary and rule effectiveness

Brute-force times are worst-case. In practice, most forgotten PDF passwords are NOT random. They are human-chosen: dictionary words, names, dates, patterns, keyboard walks. For human-chosen passwords the dictionary and rule stage usually succeeds quickly, and pattern matters more than length.

Human passwords follow predictable patterns: lowercase base word + digit(s) + optional symbol. Public breach corpora run under the best66 ruleset (best64 up to hashcat v6.2.6) capture the majority of these patterns. The probability of success depends on whether the password follows common patterns, not just its length.

A 12-character password may crack in minutes if it's 'iloveyou1234' (a known pattern in public wordlists plus a suffix rule). An 8-character random string like 'kX9#mP2q' would take centuries under mode 10700 even though it's 4 characters shorter. This is the key insight: pattern matters more than length when dictionary attacks are applied.

Practical advice for password strength

For documents you want to be recoverable if forgotten: an 8-9 character password is the realistic ceiling, and the charset matters more than the length. Lowercase-only is a matter of hours to days on a professional cluster even under mode 10700; mixed-case letters plus digits (62 characters) is roughly five months on a 32-GPU cluster under mode 10700, and minutes under the Acrobat 9 revision-5 mode. Establish which revision your files use before relying on either.

For documents that must NOT be recoverable if forgotten: use a 12+ character random password from a password manager on an AES-128 or AES-256 file (modes 10500-10700). This is unrecoverable even with maximum GPU resources. If you forget it, the document is permanently lost. This is the appropriate level for truly sensitive documents.

For legacy 40-bit RC4 PDFs (mode 10400): the key space is finite, so the document stays openable, but a password search of the same mode is not length-independent — a long random password still has to be searched. Either way, the encryption provides no meaningful protection against a determined attacker.

Estimating your PDF's crack time

1
Identify the encryption mode
Use qpdf --show-encryption for R, the permissions and the encryption method, qpdf --json for V and the key length, or our browser-based PDF encryption info tool, which reports all four values.
2
Determine per-GPU hashcat speed
Mode 10400: ~5.0 GH/s. Mode 10500: ~166 MH/s. Mode 10600: ~28.5 GH/s. Mode 10700: ~595 kH/s (hashcat benchmark rates, RTX 5090).
3
Estimate password characteristics
What do you remember about the password? Length range, character types, themes. This determines the search strategy.
4
Calculate candidate space
charset_size^length for brute-force, or dictionary_size × rules for dict+rule. Apply to per-GPU speed.
5
Factor in cluster size
Divide time by number of GPUs × 0.94 scaling factor. If the result is under 90 days, recovery is feasible.

Frequently Asked Questions

What PDF encryption mode is the fastest to crack?

Mode 10400 (40-bit RC4) is the weakest — the key space is only 2^40, minutes of GPU time. Among the password-search modes, mode 10600 (Acrobat 9 AES-256, revision 5) is fastest, at roughly 28,500 MH/s on an RTX 5090, because its key derivation is a single SHA-256. Mode 10500 (RC4-128 and AES-128) sits in the middle at roughly 166 MH/s.

What password length is secure against cracking?

For mode 10700 (AES-256 revision 6), 10 random lowercase characters is borderline — months on a 32-GPU cluster — and 11-12 characters of a wider charset is out of reach. 8-char lowercase is days on a single GPU. Short passwords fall quickly on any mode.

Does a longer password always mean slower cracking?

For brute-force, yes — each character multiplies the search space. But with dictionary attacks, a 12-char 'password1234' cracks faster than an 8-char random string.

How does PDF 2.0 affect crack times?

It does not change the cost per candidate: PDF 2.0 retains the same AES-256 Revision 6 key derivation (Algorithm 2.B, minimum 64 rounds) that PDF 1.7 ExtensionLevel 8 introduced with Acrobat X in 2010. What PDF 2.0 adoption changes is the mix of files — more AES-256, fewer RC4 and AES-128 documents.

Can a recovery service guarantee cracking my PDF?

Only for mode 10400 (40-bit RC4), and even there what is guaranteed is access to the document through a recovered key — not necessarily the original password string. For modes 10500-10700, no service can guarantee recovery — it depends entirely on password strength and patterns.

What if I only remember part of the password?

Mask attacks with known characters (e.g., '?l?l?l' + known suffix) dramatically reduce the search space. Even partial recall makes recovery an order of magnitude faster.

Have a forgotten-password PDF to recover?

Run a free analysis — encryption type detected automatically, fast techniques tried first, pay only on success.

Run Free Analysis