How To Open a Password Protected PDF Without the Password
You have a PDF that asks for a password and you do not have it. Maybe the person who set it is gone, the password was never documented, or you simply forgot. The question is whether you can open the file anyway. The answer depends on one thing: what type of encryption the PDF uses. This guide covers every realistic method and labels each by what it requires.
Step 1 — Find out what encryption type the PDF uses
Before any method applies, you need the encryption tier. Open the PDF in a text editor and look for the /Encrypt dictionary near the end of the file, or run qpdf --show-encryption file.pdf if qpdf is installed. The fields V, R and Length identify the generation.
V=1 R=2 Length=40 means PDF 1.1-1.3 40-bit RC4 (Hashcat mode 10400) — the best case. V=2 R=3 Length=128 means 128-bit RC4 (mode 10500). V=4 R=4 Length=128 means AES-128, also mode 10500 — use mode 25400 when both the user and owner password must be satisfied. V=5 R=5 Length=256 means Acrobat 9 AES-256 (mode 10600). V=5 R=6 Length=256 means Acrobat X/XI AES-256 at revision 6 (mode 10700). Each tier has a different recovery probability.
If you would rather not install software, the browser-based PDF encryption info tool reads the encryption dictionary without uploading the file. That is the fastest way to identify the tier.
No upload needed
The PDF encryption info tool runs entirely in your browser. No file is uploaded to any server. That matters because uploading sensitive encrypted PDFs to random websites carries privacy risks.
Method 1 — Professional password recovery (highest success rate)
Professional services use Hashcat on multi-GPU clusters to test millions of candidate passwords per second. They extract the encryption hash from your PDF and run dictionary attacks, rule-based mutations, mask attacks and, where the mode allows it, brute-force key search.
For 40-bit RC4 files the key space is only 2^40 — 1,099,511,627,776 candidates — so it can be enumerated exhaustively no matter how long the password was: Hashcat's collider modes 10410 and 10420 are built for that search, and on a GPU doing about 5 GH/s that sweep is 2^40 ÷ 5 billion ≈ 220 seconds, or roughly 3.7 minutes. Mode 10400 is the password-search mode for the same files, where a five-byte mask covers the same 2^40 candidates. For modes 10500 to 10700, success depends on whether the password is weak enough to find.
The best services work on pay-on-success: you pay only if the password is found. The free analysis phase tests the most common patterns and dictionary entries before any payment. If the free phase succeeds the cost is usually low; if it does not, you can decide whether to proceed from a realistic timeline estimate.
Method 2 — Chrome Print-to-PDF trick (limited cases)
The Chrome Print-to-PDF trick works on SOME password-protected PDFs: open the PDF in Chrome, go to File > Print (or Ctrl+P), choose Save as PDF as the destination, and save the output. Chrome sometimes decrypts the PDF for rendering and re-encrypts, or does not, during printing.
This only works on PDFs with owner-password protection — restrictions on printing or editing, but the document opens without a password. It does NOT work on file-open password encryption: Chrome cannot render content it cannot decrypt, so the print output is blank or an error page.
To test: open the PDF in Chrome. If it shows content without asking for a password, the trick may work for removing owner restrictions. If Chrome asks for a password, the trick will not help — Chrome does not have the password either.
Method 3 — Online unlock tools (require the password)
Online PDF unlock sites advertise that they unlock PDFs. What they actually do is accept the PDF and a password YOU enter, then decrypt with it. They do NOT crack passwords. They are browser-based decryptors, not recovery tools.
If you do not know the password, they will not help. The upload form has a password field for a reason — without it the server cannot open the file either.
Online tools CAN help in one specific case: a PDF with owner-password protection only, which opens without a password but restricts printing or editing. The file is still encrypted, but under an empty user password, so a decryptor can retrieve the key and strip the owner flags. For genuine file-open encryption, online tools provide zero benefit.
Method 4 — Adobe Acrobat 'Remove Security' (requires the password)
Adobe Acrobat — the paid desktop products, not Reader — can remove security when you supply the current password, through its Protect/Encrypt tools or the Security tab of Document Properties, where the Security Method is set back to No Security. That decrypts the PDF and saves an unprotected copy. It requires the current password, and a permissions (owner) password will not be applied without it. It cannot recover a forgotten password.
Many users believe Acrobat can recover forgotten passwords. It cannot, and Adobe documents this explicitly. Remove Security is designed for users who know the password and want to strip it permanently.
If you have Acrobat Pro and know the password, this is the fastest way. If you do not know it, skip to professional recovery.
Method 5 — Hashcat self-service (requires technical skill)
Hashcat is the industry-standard password recovery tool: free, open-source, supporting PDF modes 10400 to 10700. With a compatible GPU (NVIDIA or AMD with enough VRAM) and technical knowledge, you can run it yourself.
The workflow: extract the PDF hash with pdf2john.pl or pdf2john.py, both from the John the Ripper jumbo tree, identify the hash mode, then run a dictionary attack, for example hashcat -m 10700 hash.txt wordlist.txt -r best66.rule (best64.rule up to Hashcat 6.2.6).
Self-service advantages: no file upload, full control over the attack, no per-file fees. Disadvantages: you need a GPU (a mid-range card costs a few hundred dollars; $1,000-2,000 buys a high-end one), Hashcat experience, and time. Mode 10700 with a moderately complex password can run for weeks on a single GPU.
GPU requirement
Hashcat on CPU is roughly one to two orders of magnitude slower than on a GPU, and worst for mode 10700 — modes 10600 and 10700 are effectively GPU-bound. The 40-bit modes are light enough for a CPU to finish a bounded search, though a full sweep takes far longer than the roughly four-minute GPU figure above.
When none of these methods work
If the PDF uses AES-256 (mode 10700) with a strong random password from a password manager — 12+ characters, full character set — no method on this list can open it. The password must be known. If you remember nothing and the encryption is modern AES, the honest answer is that the document is unrecoverable.
Your remaining options: contact the author or sender for the password; check password managers, browser autofill, email archives or notes for a saved copy; or regenerate the document from the original source. Some organisations re-issue documents on request, including tax authorities and government agencies.
For future documents: save passwords in a password manager at creation time. That removes the single point of failure — you only need to remember the master password.
How to open a password-protected PDF without the password
- 1
Identify the encryption tier
Use the browser-based PDF encryption info tool, or qpdf --show-encryption for R and the encryption method plus qpdf --json for V and the key length. This tells you whether recovery is feasible.
- 2
Check for owner protection only
If the PDF opens without a password but restricts printing/editing, use any online unlock tool or qpdf --decrypt without a password. No cracking needed.
- 3
For file-open encryption, run free analysis
Submit to a professional recovery service. The free analysis tests common patterns and reports the encryption tier with a realistic success probability.
- 4
For 40-bit RC4 files (V=1/R=2)
The 2^40 key space is 1,099,511,627,776 candidates and can be searched exhaustively (hashcat's collider modes 10410/10420) at roughly 5 GH/s — about 3.7 minutes on a GPU — regardless of password length. What that returns is the file key — access to the document.
- 5
For modes 10500-10700
If the free analysis succeeds, proceed. If it does not and you remember nothing about the password, evaluate whether the document value justifies the GPU time needed.
Frequently asked questions
Can I open a password-protected PDF without the password for free?
Does the Chrome Print-to-PDF trick work on file-open password PDFs?
Is it legal to open a PDF without the password?
Can Adobe Acrobat open a password-protected PDF without the password?
What is the success rate of professional PDF password recovery?
Need a second opinion on this file?
Run the free local check first. If the file is healthy and you are authorized to recover it, you can compare the evidence with a specialist's supported workflow.
Related guides
For authorized owner use only. Recovery depends on the exact file and password; no outcome is guaranteed. FilesUnlock is a separate product from the recovery service that processes submissions.