PDF Password
Add a password to a PDF or remove one you know, right in your browser.
Loading PDF Password… If nothing happens, please enable JavaScript.
A password-protected PDF is an ordinary PDF whose content streams and strings have been encrypted, plus a small dictionary that tells the reader how to derive the key from a password. The format supports two passwords with different jobs. The open password (called the user password in the specification) is needed before anything can be displayed. The permissions password (the owner password) unlocks full rights over a file that may otherwise forbid printing, copying text or editing. A file can have either one, or both.
Examples
payslip.pdf + open password
payslip-protected.pdf (AES-256)
Asks for the password before showing anything, in any modern PDF reader.
statement.pdf (locked) + correct password
statement-unlocked.pdf
Opens without a prompt. Text, links and fonts are kept, nothing is rasterised.
brochure.pdf, printing and copying unticked, no open password
brochure-protected.pdf
Opens for everyone, but compliant readers disable print and copy.
Frequently asked questions
Is my PDF uploaded anywhere?
What is the difference between the open password and the permissions password?
Can this tool remove a password I do not know?
Which encryption does it use?
Does removing the password turn the pages into images?
How strong are the printing and copying restrictions?
What if I forget the open password?
Why does my PDF say it uses certificate encryption?
About PDF Password
This tool does both directions. To protect a document, choose an open password, decide which permissions to keep, and download an encrypted copy. AES-256 is the default, the only cipher the current PDF 2.0 standard still recommends and the one used by Acrobat, Preview and every modern viewer. AES-128 is offered for very old readers. To remove protection, load the encrypted file, type the password you were given, and the tool writes a clean copy that opens anywhere without asking. Files that only carry a permissions password open without one, so their restrictions can be lifted directly.
Everything happens inside your browser tab. The PDF is parsed, encrypted or decrypted and saved again by JavaScript on your own device, so neither the document nor the passwords travel to a server. That matters precisely for the files people want to protect: payslips, contracts, medical reports and bank statements. Unlocking keeps the document as it was: real text you can search and copy, working links, embedded fonts and form fields. Unlike online services that rasterise pages to strip protection, no page is turned into a picture.
Know what each protection is worth. An open password with AES-256 is genuine encryption: without the password, the content is unreadable, so pick a long passphrase and keep it somewhere safe, because nobody can recover it for you. Permission flags are a different matter. They are a request that well-behaved software honours, not encryption of the content itself, since the file must be readable to be displayed. Use them to discourage casual copying or printing, never as the only barrier around confidential information.
From 40-bit RC4 to AES-256: PDF Security's Rocky Road
PDF gained encryption in version 1.1, in 1994, and the first scheme reflected its era: RC4 with a 40-bit key, the most that United States export rules allowed software to ship worldwide without a licence. Keys that short could be searched exhaustively on ordinary PCs within days, and later within hours, which is why early password-removal tools did not need the password at all. PDF 1.4 in 2001 raised the key to 128 bits, and PDF 1.6 in 2004 added AES, the cipher standardised by NIST in 2001.
In 2001 the scheme also made legal history. Dmitry Sklyarov, a Russian programmer, was arrested in Las Vegas after a security conference talk about weaknesses in Adobe's eBook protection, which his employer's software could bypass. It was one of the first criminal cases under the US Digital Millennium Copyright Act. He was eventually released and his employer acquitted, but the case became a landmark in arguments about security research and copyright law.
The first version of 256-bit AES in Acrobat 9 (2008) contained a surprise of its own: to make password checks faster, it used a single round of hashing, which actually made brute-force guessing easier than the older 128-bit scheme. Adobe replaced it with a deliberately slow, iterated hash in Acrobat X, and that revision 6 handler is what PDF 2.0 standardised in 2017. Today it is the only PDF encryption method the standard still recommends; the RC4 variants and AES-128 survive only for compatibility.