Unlock PDF
Remove the password from a PDF you can already open, and lift its print and copy restrictions.
Your files stay on this device. Nothing is uploaded. How to check
How to use Unlock PDF
Key features of Unlock PDF
The document is decrypted with the password you type and written back without an encryption dictionary. RC4 (40 to 128 bit), AES-128 and AES-256 are handled.
The result is re-opened with pdf.js to confirm it opens with no password. The result line says which cipher was removed and how many pages the file has.
The password and the file stay in the page. Decryption runs in your browser with WebCrypto; nothing is sent to a server.
About Unlock PDF
Unlock PDF derives the file key from your password (MD5 and RC4 for older files, a SHA-2 based hash for AES-256), decrypts every string and stream, and saves a plain copy with the encryption dictionary removed. Owner restrictions such as no printing or no copying go with it, because they only exist inside that dictionary. A file that was never encrypted is re-saved as a clean copy and the result says so.
It helps with a bank statement you open by typing the same password every time, a form that blocks printing, or an archive you want to be able to search. It cannot break, guess or recover a password you do not have: a wrong password fails, and the tool only removes protection you can already get past. Files that use a third-party security handler are refused with a message.
When to use Unlock PDF
A report or paper opens without a password but refuses to let you copy a paragraph you want to quote. That is an owner restriction. Upload it, leave the password box empty, and the copy you download has the restriction gone; you can then take the text with PDF to Text or mark it up with Highlight PDF.
You need to merge, compress or number a protected file. Most tools on this site, including Merge PDF and Compress PDF, refuse an encrypted input. Unlock it first with its password, run the other tool on the unlocked copy, and protect the result again if you need to.
You protected a file yourself with Protect PDF and the reason for the password has passed, or the recipient's reader cannot handle AES-256. Enter the password here and keep the plain copy, or unlock and re-encrypt with a different password.
A monthly statement arrives with the same password every time and you want the twelve files in one searchable folder. Unlock each one as it arrives, then combine them at the end of the year with Merge PDF. This tool does not help with a password you have lost: there is no recovery, guessing or brute force here.
Tips and troubleshooting
- The coloured banner after upload tells you what was found: green means no encryption dictionary, amber means the file needs a password to open, blue means it opens without one but carries owner restrictions, and red means a certificate or third-party security handler that this tool cannot open, so no Unlock button is shown.
- "This PDF needs its password before it can be unlocked." means the box was left empty for a file that asks for one. "That password did not open this PDF. Check it and try again." means it was tried and rejected; passwords are case-sensitive.
- For AES-256 files either the open password or the owner password is accepted. For RC4 and AES-128 files, enter the password used to open the document; the owner password alone is not enough.
- A red banner such as "This PDF is protected with the Adobe.PubSec security handler (certificate or third-party encryption), which this tool cannot open." means the file is protected by something other than the standard password scheme, such as a certificate or a rights-management plugin, and cannot be unlocked here.
- A certificate-based digital signature inside the file will no longer verify after unlocking, because the whole document is rewritten. Keep the encrypted original if the signature matters.
- The producer, creator and dates in the file's information dictionary are left exactly as they were, but the copy is written without object streams, so it can be somewhat larger than the input. A file that was not encrypted is rewritten the same way.
- "This browser does not expose WebCrypto" appears on a plain http address that is not localhost, because browsers only offer WebCrypto on secure pages. Open the site over https. The output is named unlocked_ followed by the original filename.
- To put a new password on the unlocked copy, see how to password protect a PDF.
How Unlock PDF works in your browser
As soon as you choose a file it is read into memory and checked twice. pdf.js tries to open it without a password, which tells the tool whether a password is needed at all, and the site's pdf-crypto module opens it with pdf-lib in a mode that ignores encryption, reads the trailer's /Encrypt dictionary and records the security handler revision. Those two answers decide which banner you see and whether the password box is required.
When you click Unlock & Download PDF, pdf-crypto derives the file key from the password. For revisions 2 to 4 that is the MD5 and RC4 recipe of the older specification, implemented in plain JavaScript because WebCrypto has neither; for revisions 5 and 6 it is the SHA-256, SHA-384 and SHA-512 hash chain run through WebCrypto, with AES to unwrap the key. The tool then walks every object in the file and decrypts each string and stream (RC4 or AES-CBC as the dictionary says), removes /Encrypt from the trailer, and has pdf-lib serialise the plain document. pdf.js opens the result once more to confirm no password is asked for, and only then is the Blob offered for download. The file and the password never leave the page.
Frequently asked questions
Do I need to know the password?
Only if the PDF asks for one when you open it. If it opens normally but blocks printing or copying, those are owner restrictions and can be removed without a password.
Can this crack a password I do not know?
No. The tool decrypts with the password you supply and fails if it is wrong. Removing protection from a document you are not authorised to open may also be unlawful where you live.
Which kinds of encryption are supported?
RC4 at 40 to 128 bits, AES-128 and AES-256, which are the ciphers the PDF standard security handler uses. A document that uses a third-party security handler cannot be opened.
Does the owner password work instead of the open password?
For AES-256 files, yes: either password is checked and accepted. For RC4 and AES-128 files only the password used to open the document is checked, so enter that one.
Will a digital signature in the file survive?
No. Unlocking rewrites the whole document, so a certificate-based signature will report the file as modified afterwards. Keep the encrypted original if you need the signature to verify.
Is the unlocked copy otherwise identical?
The pages, text, images, bookmarks and form fields are the same, and the information dictionary is left untouched. The file is written without object streams, so it can be somewhat larger than the encrypted version.
Last reviewed