If the file opens and then restricts you from printing or copying, that is an owner password. It comes off without knowing it, because those restrictions were never enforced by encryption in the first place.
If the file demands a password before it will open at all, the contents are genuinely encrypted. Modern PDFs use AES-256, and against a password that is not guessable, there is no practical way in.
Almost everything written about forgotten PDF passwords is written by people selling recovery software, which makes it hard to get a straight answer. The straight answer is that it depends entirely on which of two very different locks you have run into, and most people have run into the easy one without realising it.
Work out which lock you have
The test takes two seconds. Double-click the file.
Owner password, also called permissions
- The document displays normally with no prompt
- Printing, copying or editing is blocked
- Restrictions are advisory, enforced by the reader
- The content was never actually encrypted from you
- Removable in seconds without knowing the password
User password, real encryption
- Nothing displays until the password is entered
- Page content is genuinely encrypted on disk
- Modern files use AES-256, which is not breakable
- No tool can read it without the key
- Recovery means guessing, and usually failing
If the file is genuinely encrypted
Then the page content on disk is ciphertext, and the password is what derives the key to decrypt it. Without the key there is nothing to read, which is exactly what the encryption was for.
How bad that is depends on the age of the file and the quality of the password. The encryption in PDFs has improved substantially over time, and old files are genuinely weaker than new ones.
- Acrobat 3 and 4, 40-bit RC4Breakable, hours to days
- Acrobat 5 to 8, 128-bit RC4Only weak passwords realistic
- Acrobat 7 and later, AES-128Strong, password quality decides
- Acrobat 9, AES-256 early formWeaker key derivation, faster to attack
- Acrobat X and later, AES-256Effectively unbreakable
- PDF 2.0, AES-256Effectively unbreakable
For anything created in the last fifteen years, the encryption itself is not the weak point. The password is. A dictionary word, a name, a date of birth or a short phrase can be found by a tool that tries millions of candidates a second. A long random string cannot, and no amount of computing time changes that within a human lifetime.
Where the password actually is
Before spending money on recovery software, spend ten minutes looking. Passwords on PDFs are rarely memorised, which means they were almost always written down somewhere.
Your password manager
Search by the filename, the sender's name or the organisation that issued the document. PDF passwords get saved here more often than people remember doing it.
The email that delivered the file
Bank statements, payslips and insurance documents usually arrive with the password convention in the covering email, or in the one before it. Search your mail for the sender rather than the file.
The convention, not the password
Institutions rarely pick random passwords. It is your date of birth in some format, your postcode, the last digits of an account number, or your surname and a year. The pattern is often printed in the letter itself.
Whoever sent it
Unglamorous and by far the highest success rate. One message asking for the password takes a minute and works far more often than any tool.
If it is only restrictions
This is the good outcome and it is the more common one. The document opens, you can read it, and it will not let you print or copy. The file is not encrypted against you in any meaningful sense.
Removing the restrictions produces an identical document with the permission flags cleared. Nothing is decrypted because nothing was encrypted, and the page content is bit-for-bit what it was.
What to do when it really is lost
If the file is encrypted, the password is genuinely unknown and it is not a weak one, the honest position is that the document is not recoverable. Accepting that quickly is worth more than a week of tools.
The productive question becomes where else the content exists. Request a fresh copy from whoever issued it, which is usually trivial for statements and invoices. Check whether an unprotected version was ever saved, emailed or printed. Look for the source document the PDF was generated from, since the original spreadsheet or word processor file is rarely protected even when its PDF export is.
Remove a password you already have
Unlock a document you own, in your browser. The file and the password never leave your machine.
Common questions
The things worth knowing before you start trying tools.
01Can any tool crack a PDF password?
Only by guessing it. For files using modern AES-256 encryption there is no shortcut and no flaw to exploit, so a tool is limited to trying candidate passwords very quickly. That works against dictionary words and short passwords, and it does not work against anything genuinely random.
02My PDF opens but will not let me print. Is that the same thing?
No, and that is the important distinction. That is an owner password, which sets restriction flags rather than encrypting the content. Readers choose to honour those flags, so removing them requires no password at all.
03Why do some sites claim they can unlock any PDF instantly?
Because they are almost always removing owner restrictions, which genuinely is instant, and describing it as unlocking. That is a real service for a real problem, but it is not the same as recovering an encrypted document, and nothing removes a good user password in seconds.
04Is it legal to remove a PDF password?
For a document you own or have the right to use, generally yes. For copyrighted material you licensed under terms that prohibit it, generally no, and in some jurisdictions circumventing a protection measure is an offence independent of copyright. Technical ease is not the test.
05How long would brute forcing take?
For a weak password, minutes. For eight random characters, a very long time. For a passphrase of several random words, longer than is worth discussing. Each additional character multiplies the work, which is why length matters far more than mixing in symbols.
06What is the single most effective thing to try?
Ask the sender. It feels like giving up and it resolves more cases than every recovery tool combined, usually within the hour. For institutional documents, requesting a fresh copy is often faster still.