PDF password remover

A PDF has two passwords, and most people have only met one

This is the thing worth knowing before anything else, because it explains almost every confusing case.

The user password is the one you are asked for when you open the file. Without it the document will not display at all.

The owner password is never asked for. It governs what you may do once the document is open: print it, copy text out of it, edit it, extract a page. A document with an owner password and no user password opens for anyone, immediately, and then refuses to let you select a line of text.

That second kind is what most people mean by a locked PDF, and the restriction on it is a request rather than a lock. The file is encrypted, but with a key derived from an empty password, which is to say from the file itself. Every viewer already computes it in order to put the page on your screen; it then reads the permission flags and volunteers to obey them. Leave the password field empty here and the protection comes off, and nothing about who can read the document has changed.

What this will not do

It will not open a document whose password you do not have. It tries the password you type, once, and reports what happened. There is no list of common passwords to work through and nothing that varies an attempt and tries again.

That is a decision rather than an unfinished feature. A tool that removes a password somebody supplies is a tool for people handling their own statements and payslips. A tool that searches for one is a different thing entirely, aimed at a different person, and the two are about one loop apart in the code. The loop is not there.

It is also worth knowing that for a modern document the search would not work. AES-256 protection deliberately makes every attempt expensive, so guessing at a password of any length is a matter of years rather than minutes. A site that offers to do it either wants your document on its server or is only useful against files from twenty years ago.

Nothing is sent anywhere

The documents people bring to a page like this are the ones they would least like to hand to a stranger: bank statements, salary slips, tax papers, medical letters. So the work happens in this tab, in JavaScript, on bytes your browser read from your own disk.

There is no request in this page that could carry a file anywhere, because there is no network code in it at all. The way to check that is not to take anyone’s word for it: load this page, turn off your network, and unlock a document. It works, because there was never anything for it to talk to.

Your password is held in the page while it is open and nowhere else. It is not stored, not put in the address bar, and not written into the document that comes out.

What comes out

The same document, without the encryption. Its pages, text, fonts and images are the bytes that were already in your file: they are unwrapped from the encryption and written back untouched, still in whatever compression they arrived in. Nothing is re-encoded, so there is no second generation of loss on a scan and no reflowed text.

What does change is the file’s skeleton. The index saying where each object lives is rebuilt in the plainest form the format allows, and objects that were packed together inside other objects are written out separately. The unlocked copy is therefore often a slightly different size from the original, sometimes larger, and that difference is structure rather than content.

Every unlocked copy is then read back and checked before you are offered it. Its index has to land on real objects, its root has to still be a catalogue, and it has to have the same number of pages it started with. A document that fails any of those is refused rather than handed over, because a statement that opens and is quietly missing a page is the one failure nobody notices until it matters.