How to Remove a PDF Password
Three proven methods to unlock password-protected PDF files — from free browser tools to professional recovery services. Learn which method works for your specific encryption type.
Don't know your encryption type?
Use our PDF Encryption Analyzer first — it reads your file locally (nothing uploaded) and tells you exactly which method to use.
Step 1: Understand Your PDF's Encryption
Before attempting recovery, you need to know what you're dealing with. PDF encryption has evolved significantly, and the method that works for a 2001-era PDF will completely fail on a 2020 PDF — and vice versa.
PDF files store encryption metadata in a structure called the /Encrypt dictionary. The most important field is /R (Revision), which tells you exactly how the password was hashed and what key length was used.
| Revision (/R) | Encryption | Key Length | Feasibility |
|---|---|---|---|
| R=2 | RC4 | 40-bit | Finite-key recovery |
| R=3 | RC4 | 128-bit | Password-dependent |
| R=4 (AES) | AES-128 | 128-bit | Password-dependent |
| R=5/R=6 | AES-256 | 256-bit | Weak passwords only |
40-bit PDFs (R=2) are special: The 40-bit RC4 key space is finite. R=3 is a different 128-bit RC4 revision and depends on the password, so it belongs in the password-dependent category.
Method 1: Free Online Tools
Free online PDF unlockers are the first thing most people try. They're convenient but come with significant limitations — and serious privacy concerns you need to understand before uploading confidential documents.
How they work
Most free online tools use one of two approaches: (1) they attempt to remove the owner/permissions password (always works, no recovery needed) or (2) they run a basic dictionary attack against the user/open password. Option 1 is instant. Option 2 only works if your password is in their database.
Popular free tools
Easy UI, removes permissions instantly, weak on encrypted PDFs
Similar to Smallpdf, free tier with file size limits
Decent basic recovery, stores files on EU servers
Built-in, works if you can open the file but want unrestricted copy
Privacy warning
Free online tools require you to upload your PDF to their servers. For confidential documents (contracts, financial records, medical files), this is a significant risk. The file may be stored, analyzed, or retained even after "deletion." Always check the privacy policy before uploading sensitive documents.
Limitations of free tools
- —Only check passwords against small dictionaries (typically under 10 million entries)
- —Cannot crack strong or unique passwords (random strings, long passphrases)
- —File size limits (usually 10–50MB on free tier)
- —Require internet connection and file upload
- —Not a practical target for strong modern AES without useful clues
- —Often don't tell you why recovery failed
Method 2: Desktop Recovery Software
Desktop software gives you more control, keeps your file local (better privacy), and can leverage your computer's full processing power. The downside is cost and setup time.
Top desktop tools
✓ Most powerful, GPU-accelerated, supports all attack types
✗ Command-line only, steep learning curve, requires GPU for best performance
✓ Wide format support, good auto-detection
✗ Slower than hashcat for GPU attacks
✓ GUI, live memory analysis, broad format support
✗ Expensive, overkill for single PDF
✓ Easy GUI, GPU acceleration, specifically for PDF
✗ Windows only, expensive
Using Hashcat for PDF recovery (advanced)
If you're comfortable with the command line, hashcat is the most powerful free option. Here's the basic workflow:
# Step 1: Extract the hash from your PDF
pdf2john.py protected.pdf > hash.txt
# Step 2: Run dictionary attack
hashcat -m 10500 hash.txt rockyou.txt
# For 40-bit PDFs (finite-key assessment)
hashcat -m 10400 hash.txt --bruteforce-attack
Note: Mode numbers — 10400 = PDF 1.1-1.3 (40-bit RC4), 10500 = PDF 1.4-1.6 (128-bit RC4/AES), 10600 = PDF 1.7 Level 3, 10700 = PDF 1.7 Level 8
Method 3: Professional Recovery Service
When free tools fail and you don't have the technical skill or hardware for desktop software, professional recovery services are the practical option. They run GPU farms with billions of password candidates — dramatically better than anything a personal computer can achieve.
The key advantage is scale. A mid-range gaming GPU can test around 1 billion passwords per second against a PDF hash. A professional service with 10–20 high-end GPUs can test 10–20 billion per second, making recovery of moderate passwords (short phrases, names with numbers) feasible within hours.
Can't Open Your PDF?
Free PDF password check with paid release only after proof. Your local price shown before payment applies only if recovery works.
When to use a professional service
- You've already tried free tools and they failed
- The PDF is important enough to be worth paying for
- You don't want to spend days learning hashcat
- Your PDF has AES-128 encryption and the password might be a real word or phrase
- You need the file recovered within 24–48 hours
Removing Owner / Permissions Password
If your PDF opens fine but you can't print, copy text, or edit it, you have an owner password (also called a permissions password or restrictions password). This is completely different from an open password.
Owner passwords are technically trivial to remove. The PDF specification allows the file to be "restricted" by the owner password, but the actual content is not encrypted with it — it's encrypted with a standard key derived from the user (open) password. Removing owner restrictions requires no cracking at all.
3 ways to remove permissions restrictions
1. Print to PDF (built into every OS)
If the PDF opens and the restriction is only an owner/permissions flag, print to PDF or save a new copy. The result depends on the reader, document policy, and whether the file has a separate open password.
2. Free online tools
Any of the tools mentioned above (Smallpdf, IlovePDF) will strip owner passwords instantly. No cracking required — they simply re-save without the restrictions flag.
3. QPDF (command line, free)
qpdf --decrypt input.pdf output.pdf
Works for owner-only restricted PDFs. Will prompt for user password if the file also requires one to open.
Feasibility by Encryption Type
Feasibility depends on the encryption revision, file health, password clues, and the candidate search that can be justified for the owner. Use these categories instead of an unsupported universal percentage:
40-bit RC4 (R=2) — finite-key candidate
- —The 40-bit key space is finite and exhaustible — every possible key can be tested
- —The key space is finite, but the exact variant and file health still need to be verified
- —Password composition matters less because the analysis targets the legacy key space
- —The free check confirms whether this route is appropriate
AES-128 (R=4) — password-dependent
- —Common passwords and owner-provided patterns are the strongest candidates
- —Complex random passwords are usually outside a practical search
- —Candidate throughput varies by hardware and attack design
- —The search budget is set after the file and clues are assessed
AES-256 (R=5, R=6) — weak passwords only
- —Strongest modern encryption, used in Acrobat X and later
- —Only tightly bounded dictionary or pattern searches are worth assessing
- —Long random passwords are usually outside a practical search
- —A short common password may still be a candidate when the pattern is known