PDF 1.1-1.3 RC4 40-bit Encryption — Hashcat Mode 10400

How PDF 1.1-1.3 stores its password

PDF encryption arrived in 1996 with PDF 1.1, using what Adobe calls the Standard Security Handler, configured as V=1 and R=2 in the document's encryption dictionary. Your password is combined with the document's permission settings and a file identifier, run through a step based on MD5, then cut down to 5 bytes — exactly 40 bits. The 50-round strengthening that later revisions add does not exist at this revision.

Once derived, that 40-bit key encrypts every string and stream in the PDF. The encryption dictionary itself stays in clear text, which is why an analyzer can identify a file as V=1/R=2 without decrypting anything.

The key length is the binding constraint. RC4 as a stream cipher is considered broken in general — TLS retired it in 2015 under RFC 7465 — but for this PDF revision the practical weakness is the 5-byte key: only 2^40, about 1.1 trillion possible keys.

• V (algorithm version) = 1
• R (revision) = 2
• Length = 40 (bits)
• Cipher: RC4 with key truncated to 5 bytes
• Padding: PDF Standard Security Handler 32-byte string

Why 40 bits is below the modern security floor

Forty bits exists because of a US export-control compromise in the 1990s. Encryption stronger than that needed an export licence under the Export Administration Regulations, so commercial software shipped the weakened variant worldwide. Adobe followed the same convention until the rules relaxed in 2000.

For comparison, NIST now recommends at least 112 bits of effective strength for symmetric ciphers (NIST SP 800-131A). PDF 1.4 moved to 128-bit RC4, and PDF 1.7 to AES-128 and later AES-256.

Because the key derivation is deterministic and the verification path is well defined by the user-password padding string, the recovery problem reduces to finding the key rather than the password. That is what makes mode 10400 unusual among Hashcat modes: a successful key search yields plaintext access regardless of how complex the original password was.

Identifying a 40-bit PDF without opening it

The encryption dictionary inside a PDF is not itself encrypted, so the algorithm version and revision are readable in any text editor. A line like /V 1 /R 2 /Length 40 — or an omitted Length, which defaults to 40 when V=1 — confirms 40-bit RC4. This is documented in Adobe PDF Reference 1.3, section 3.5.

Adobe Acrobat 5.0, released in 2001, was the last consumer release that defaulted to 40-bit. Files produced by Acrobat 2 through 5, by older Adobe Distiller versions, or by third-party libraries using the legacy security handler all fall into this category.

Pre-flight tools such as the qpdf command line, pdfinfo from poppler-utils, or the pikepdf Python library expose the V/R/Length values without requiring the password.

• Look for /V 1 and /R 2 in the encryption dictionary
• /Length will be 40 or absent (the default for V=1)
• Acrobat versions 2-5 (1996-2003) typically produced these files
• The PDF version metadata (for example %PDF-1.3) is a strong hint but not authoritative

Recovery feasibility — what to expect

Because the key is short by modern standards, PDF 1.1-1.3 is the most predictable recovery category there is. Password composition matters less than the finite key, though the exact implementation, the file's health, and the verification result still matter.

Once a key is established, the PDF can be re-saved without the password while preserving the content the tool can successfully read. Check output integrity, and any signature or metadata requirements, on the individual file.

The finite key space makes a technical route possible in principle. The service still needs a readable file, sufficient compute, and a verified result — the file extension alone is not an outcome guarantee.

Why these files still appear in 2026

The usual sources of 40-bit PDFs today are archived tax returns and government documents from the 2000s; legal disclosure bundles where the original was scanned and protected with an older tool; bank statements exported from internet-banking portals that were never modernised; and engineering or pharmaceutical drawings kept long-term in document management systems that preserve the original encryption.

When organisations migrate document archives, the original encryption is often preserved by default rather than upgraded. A PDF created with Acrobat 4 in 2001 can therefore still be encrypted with 40-bit RC4 today, even after several round-trips through modern systems.

PDF/A, the ISO 19005 archival format, does not mandate stronger encryption — PDF/A-1 explicitly allows the original encryption to be retained. A long-term-preserved archive may still contain 1990s cryptography.

Adobe's revision history at a glance