PDF 1.4-1.6 RC4 128-bit Encryption — Hashcat Mode 10500

What PDF 1.4 changed

Released in 2001 alongside Acrobat 5.0, PDF 1.4 introduced V=2 and R=3 in the Standard Security Handler. The cipher stayed RC4, but the key length became configurable from 40 up to 128 bits in 8-bit steps. From then on, virtually every commercial tool producing password-protected PDFs defaulted to 128-bit.

PDF 1.5 (Acrobat 6, 2003) and PDF 1.6 (Acrobat 7, 2004) reused V=2/R=3. Acrobat 7 also introduced V=4/R=4 with AES-128 as an option, but RC4 stayed the default for several more years for compatibility.

The encryption dictionary now carries /V 2 /R 3 /Length 128. Length became mandatory for V=2 because it was no longer fixed by the algorithm version.

• V (algorithm version) = 2
• R (revision) = 3
• Length: 40-128 bits (almost always 128)
• Cipher: RC4 with full configurable key length
• Padding: same Standard Security Handler 32-byte string
• This mode also covers AES-128 (V=4/R=4): Hashcat parses both revisions as mode 10500, because the password check is the same 50-iteration MD5 derivation in each

Why 128-bit recovery is fundamentally different

At 128 bits the key space expands to 2^128, roughly 3.4 × 10^38 — far beyond any realistic compute budget. The binding constraint shifts from the key to the password itself: the key derivation (still based on MD5 and the 32-byte padding) is deterministic, so given a candidate password a verifier can be computed and compared against the stored values in the encryption dictionary.

In practice, recovery for mode 10500 follows the rules of password attack rather than cryptographic attack. If the password was short, predictable, dictionary-based, or built from common patterns — a year, a name, simple substitutions — recovery is feasible on reasonable timescales. If it was long, random and high-entropy, it becomes asymptotically out of reach.

There is no shortcut at the cipher level. RC4 has theoretical biases, but PDF's key derivation isolates the cipher key from the password input, so those attacks do not apply.

What feasibility actually means here

Feasibility for 128-bit RC4 PDFs lives on a spectrum, not a binary. The single biggest predictor is whether you can give the service hints about what the password probably looked like: a common pattern, a length range, an old password you used to use, the year the file was created, the author's name. Hints that narrow the space turn an intractable brute force into a directed search.

A 6-character lowercase-only password is recovered very quickly because the space is tiny (26^6, about 308 million). A 12-character mixed-case password with digits and symbols is roughly 10^23 times harder. Same algorithm, same hardware, entirely different recovery curves.

We do not publish specific recovery probabilities, because they depend heavily on what the password was. What we will say: if you remember the rough shape — length, character classes, a few words you might have used — provide that up front. It is the difference between a practical recovery and a calculation that finishes after the sun burns out.

Acrobat 6 and the compatibility tier

Acrobat 6 (2003) was the first version to default to 128-bit RC4 for password-protected exports. It also introduced the per-permission controls — printing, copying, modification — that organisations relied on for distribution control.

Permission flags are stored in the P field of the encryption dictionary as a signed 32-bit integer and can be read without the password. But the cipher encrypts strings and streams unconditionally, so even with the permissions readable, the content still has to be decrypted first.

A common misconception is that the owner password is fundamentally different from the user password for recovery. It is not: the owner password is hashed into a key that decrypts a real user password, and the document is encrypted with the user-password-derived key. Mode 10500 recovers the user password, which gives full read access regardless of which type was originally set.

Files commonly in this revision

PDF 1.4-1.6 with 128-bit RC4 dominates the corporate-era encrypted PDF population: mid-2000s tax filings, legal disclosure exports, payroll bundles, contractor agreements, and bank statements from 2003-2010. Many small-business document systems standardised on Acrobat 6 or 7 and kept producing the format for years afterwards.

Government archives are heavy in this revision because software procurement cycles are long. HMRC, ATO, IRS and CRA notices from this era are predominantly mode 10500 with 128-bit keys.

Modern Acrobat (XI, DC, Pro 2020+) defaults to AES-256 (mode 10700), so freshly generated files are usually not in this category. But anything re-saved from an older template, or produced by an automation pipeline nobody updated, can still emerge as 128-bit RC4.

Practical questions for owners considering recovery

Three questions decide whether recovery is realistic. First: do you remember the password's general shape? A length range, a likely word, a favourite number — these narrow the search dramatically. Second: was the password generated by a password manager or chosen by a human? Manager-generated passwords are random by design and typically out of reach; human-chosen passwords cluster around predictable patterns. Third: what is the document worth? A free check costs nothing and gives a quick technical readout; a paid attempt is justified when the document has clear value.

The honest assessment for mode 10500 is that success rates depend on password type. We will not quote a single number. We tell you what the free-check phase found before you commit to anything paid.