You forgot the password to a PDF. Now what?

First, find out which lock you have

A PDF can be protected in two completely different ways, and they get described with the same words even though only one of them is encryption.

The test takes a second. Does the file demand a password before showing you anything at all? If yes, that is a user password — sometimes called an open password — and the document's contents are genuinely encrypted. If the file opens straight away but blocks printing, copying or editing, that is an owner password, which is a set of permission flags rather than encryption.

That distinction decides everything that follows, and it is why one person's "I forgot my PDF password" is solved in five seconds and another's is not solvable at all.

The good case: permissions only

If the document opens without a prompt, you are in luck, and it is worth understanding why.

Permission restrictions are flags stored in the file asking a well-behaved reader to disable printing or copying. The content was never hidden — you can already see it. The restriction is a request to software, not a barrier around the data.

So removing it needs no password. A tool that rebuilds the document without those flags produces an unrestricted copy, and nothing is being cracked, because there was nothing to crack. The absence of the password is not an obstacle here.

The hard case: a real open password

If the file will not open at all, the honest answer is that no tool can reliably get you in without the password, and you should be suspicious of any that claims otherwise.

The content is encrypted with a key derived from the password. Without it, there is no shortcut — the only approach is guessing, and modern PDFs are specifically designed to make guessing expensive. Revision 6 of the standard, used by anything recent that offers 256-bit AES, deliberately runs an iterated hash requiring at least 64 rounds of hashing and encryption per attempt. That cost is the point.

What that means practically: a short or common password may fall to a dictionary attack. A long or random one will not, on any timescale that matters. Files encrypted with older revisions using 40-bit RC4 — genuinely old documents — are weak enough to attack, but that is a shrinking population.

Any service promising to recover a modern PDF password instantly is either finding a weak password, exploiting a file that turned out to be permissions-only, or not doing what it says.

Things worth trying before giving up

In rough order of how often they work:

• Check whether it opens at all. A surprising share of "forgotten password" problems are permissions restrictions, which need no password.
• Look for the source document. If the PDF was exported from a word processor or a design tool, the original is unprotected and re-exporting is faster than any recovery attempt.
• Ask whoever sent it. Obvious, routinely skipped, and by far the highest success rate. Institutions that issue encrypted statements usually derive the password from something predictable — a date of birth, the last digits of an account number — and will tell you the pattern.
• Check your password manager and your usual patterns. People reuse a small set for documents.
• Look for a printed or forwarded copy. A version that was printed to PDF, or forwarded after being opened, is often unencrypted.

A note on where you do this

If you do have the password and want an unprotected copy, be careful where that happens. Uploading a confidential document and its password to a web service means handing both to a third party — the file, the key, and the fact that they belong together.

That is a poor trade for a document worth encrypting in the first place. A tool that does the work locally in your browser never receives either, which is the property you actually want for this specific job.

Frequently asked questions