How to Remove a Password from a PDF (When You Have Permission to Do So)

Understand how PDF passwords work, what you can and cannot remove without the password, and the legal boundaries. Then remove the password in your browser without uploading the file.

7 min read

Two kinds of PDF passwords that most people confuse

PDF passwords are not one thing, there are two distinct passwords and they do very different jobs. Whether you can remove a password depends entirely on which kind you are facing.

User password (also called the "open" password). This is the one that stops the PDF from opening at all. Type it and you see the document; type it wrong and the viewer refuses. This password is part of the encryption key. Without it, the file bytes are literally unintelligible, they cannot be read even with a hex editor.

Owner password (also called the "permissions" password). This one lets the PDF open freely but restricts what you can do with it: no copying text, no printing, no editing, no filling forms. Most recipients never encounter this as a password prompt because the viewer applies the restrictions automatically. To change the restrictions, though, you need the owner password.

The two passwords can be set independently. Some PDFs have only a user password, some only an owner password, some both. Removing them requires different approaches.

What can be removed and what cannot

Being honest about the limits:

With the user password: you can decrypt the file completely. Once you know the password, the tool uses it to derive the encryption key, decrypts the content, and writes out an unencrypted PDF.

Without the user password: you cannot open the file, let alone decrypt it. This is by design, PDF encryption is real cryptography (RC4 for old PDFs, AES-128 or AES-256 for modern ones). If your only recourse is guessing, plan for it to take longer than the heat death of the universe on strong passwords.

Owner password only, no user password: any PDF library can read the file's content because it is not encrypted at the byte level. The owner password is a policy enforced by the viewer, not a cryptographic guarantee. Tools can bypass owner-password restrictions without knowing the password. Whether you should is another question covered below.

PDF encryption schemes over time

The security depends on which PDF version the file was created with:

PDF version Encryption Key length Practical security
PDF 1.3 (2000) RC4 40 bits Broken. Can be brute-forced in hours
PDF 1.4 (2001) RC4 128 bits Weak but not easily broken
PDF 1.5-1.6 (2003-2005) RC4 or AES 128 bits Reasonable
PDF 1.7 (2008) AES 128 bits Strong
PDF 2.0 (2017) AES 256 bits Very strong

The RC4-based schemes have known weaknesses, and 40-bit RC4 in particular is effectively broken. The AES-based schemes remain strong when paired with a good password. If your file was made with modern software (2020+), assume AES-256.

This section matters more than the technical detail. Password-protected PDFs exist because someone wanted to control access. Removing the password legally is fine if:

  • You own the document
  • The document was intended for you and you were given the password
  • You have written or implied permission to modify it
  • You are recovering access to your own historical files

Removing the password is not fine if:

  • The password was withheld from you deliberately
  • You are trying to bypass access controls set by a former employer, a copyright holder, or a system that requires the password for a reason
  • You are working around DRM on commercial documents (ebooks, training materials with a per-user password)

Jurisdictions treat this differently, but "I found this PDF online with a password" is not a justification. Neither is "the person who sent it forgot the password", ask them to resend it without the password instead.

How to remove the password in your browser

Assuming you have the password legitimately, our Password Protect tool handles the decrypt flow entirely in your browser.

1. Open the PDF

Drag the file into the drop area. The tool detects that the file is encrypted and prompts you for the password.

2. Enter the password

Type the user password. The tool passes it to pdf-lib, which uses the password to derive the encryption key and decrypt the file's object stream. This happens locally. The password is never sent anywhere.

If the password is wrong, pdf-lib throws an error and the tool prompts you to try again. There is no rate limit and no lockout; you can try as many times as you like. That is not a security weakness, the encryption itself protects the file. Brute forcing a strong password remains computationally infeasible.

3. Choose "Remove password"

The tool offers three modes: add a password, remove a password, and change a password. Pick remove.

4. Download the decrypted PDF

The output is a plain PDF with no encryption. All content is preserved: text, images, fonts, form fields, annotations, and bookmarks. The original file on your device stays encrypted; a new plain file is generated.

What happens if you only have the owner password

Some tools can bypass owner-password restrictions by rewriting the file to remove the restriction flags. pdf-lib reads a password-restricted PDF (as long as there's no user password), then writes it out with the restriction flags cleared. The result is a PDF that behaves as if the restrictions never existed.

This works because owner-password restrictions are enforced by the viewer, not the file bytes. A cooperative viewer respects them; a non-cooperative library ignores them. This is why owner-password protection is best thought of as a signal ("please don't copy this") rather than actual security.

If your goal is to preserve legitimate ownership signals, do not strip the owner password, instead, redact the content that needs protecting.

Alternatives when the password is unknown

Sometimes people ask for password removal because they legitimately own the file but forgot the password. Options in order of practicality:

  • Check your password manager. Most PDF passwords end up saved somewhere.
  • Ask whoever sent the file for the password again, or ask them to resend without protection.
  • Print to PDF from within the viewer. Once open, print ā†’ "Save as PDF" produces an unencrypted copy. Works if the file opens for you but is restricted from editing (owner-password only).
  • Password recovery tools. For weak passwords on old PDFs (RC4-40 or short RC4-128), commercial tools can brute-force in hours to days. For AES-256 with a strong password, no consumer tool will crack it in reasonable time.
  • Give up and reconstruct. If the file is documentation you wrote and lost the password to, retyping is often faster than cracking.

Frequently asked questions

Is my password sent anywhere when I decrypt the PDF in the browser?

No. The password is passed to pdf-lib inside your browser tab and used to derive the decryption key. Neither the password nor the file leaves your device. If a browser-based tool asks you to "upload the file to our secure server for password recovery," that tool is not browser based, and you should be sceptical about where your file and password end up.

Can I remove the password without knowing it?

For owner-password-only PDFs, yes, the restrictions can be bypassed. For user-password-protected PDFs, no. The encryption is real, and without the password, the file bytes cannot be decrypted. Any tool claiming to remove any PDF password instantly is either misleading or is performing an owner-password bypass but marketing it as universal.

What if my password contains special characters?

PDF passwords are stored as UTF-8 in modern PDFs but as PDFDocEncoding in older ones (pre-1.7). Special characters like Ć©, ā‚¬, or Ā® may work differently depending on which encoding the file uses. If a password containing special characters fails, try typing it with the special characters replaced by their ASCII equivalents, or open the file in the original software that set the password.

Will removing the password change the file otherwise?

Yes, slightly. The output PDF has the encryption dictionary removed, the file structure is rewritten, and the object numbering may shift. Content (text, images, forms, signatures) is preserved bit-for-bit in terms of appearance and behaviour. But cryptographic hashes of the file will differ from the encrypted version.

Can I remove the password from a batch of PDFs?

Our browser tool handles one file at a time. For batches, either process each file manually or use a command-line tool like qpdf in a script:

qpdf --password=YOUR_PASSWORD --decrypt input.pdf output.pdf

That is not a browser workflow, but it is the right tool for processing hundreds of files.

Depends on the jurisdiction and the purpose. In many places, bypassing restrictions on a document you own or have permission to use is fine. Bypassing restrictions on commercial ebooks or training materials to redistribute them is not. When in doubt, consult the licence attached to the file.