Blog

Forgot a PDF password? What can and cannot be recovered

The password is not stored in the PDF, so nothing can read it out. What you can do instead, where to look first, and when the file is simply gone.

By Harish5 min read

If you have forgotten the password to a PDF, nothing can read it back out of the file, because the file does not contain it. What you can do depends on which kind of password it is. If the PDF opens and only refuses to print or copy, you do not need the password at all. If it asks for a password before it opens, your options are finding the password, finding an unlocked copy, or guessing, and guessing only works if the password was weak.

That is the honest version. Most pages ranking for this search are selling “recovery” software, and they tend to leave out the part where recovery means guessing.

First, check which password you forgot

This takes ten seconds and it changes everything that follows.

Open the file. If you see the pages, the password you are missing is a permissions password, which only stops printing, copying or editing. That kind can be removed without knowing it, and you can stop reading here: our unlock tool will spot it and remove it with no password. The details are in secured PDF will not print or copy.

If a password prompt appears before anything else, you are missing the open password. That is real encryption, and the rest of this post is for you.

Why nothing can read the password out of the file

When a PDF is locked, the password is turned into an encryption key and the key scrambles the content. What goes into the file is not the password but a check value: a number computed from the password, enough for a viewer to tell a right password from a wrong one.

So a “PDF password recovery” program cannot look the password up. The only thing it can do is try passwords one after another, computing the check value for each, until one matches. Every product in this category, free or paid, works this way. The good ones are fast at guessing. None of them skip it.

How that goes for you depends on two things.

How the file was locked. Files locked with the oldest method, 40-bit RC4, are a special case: the key is so short that it can be found directly by trying every possible key, and the password stops mattering. Every later method uses 128-bit or 256-bit keys, where that is impossible, and the only route is guessing the password itself. The newest method, 256-bit AES in PDF 2.0, is also deliberately slow to check, so each guess costs more.

How guessable the password was. Here the arithmetic is blunt.

  • A date of birth has around 36,500 possibilities across a century. That is nothing. It falls in seconds.
  • A short dictionary word with a number on the end falls in minutes or hours.
  • Eight random characters, mixing cases, digits and symbols, against a 256-bit file, is out of reach for anyone without serious hardware and a lot of time.
  • Twelve or more random characters is out of reach for everyone.

So if you chose a strong password and forgot it, the content is gone. That is not a failure of the tools. It is the encryption working exactly as you asked it to.

Where to look before anything else

The password is often findable, because most locked PDFs were not locked by the person trying to open them.

  1. The message the file came in. Banks, tax portals and payroll systems nearly always state the password format in the email or on the download page. Search your inbox for the sender’s name plus “password”.
  2. A second message. People who lock a PDF properly send the password separately, often by text or in a follow-up email a minute later.
  3. The issuer’s published format. Statements, ID documents and tax forms use formats built from your own details: a date of birth, part of your name, part of an account number. We have collected the common ones in the password for your bank statement PDF.
  4. Your password manager and browser. If you set the password yourself, you may have saved it without realising, especially if the PDF was exported from an online service.
  5. Details that trip people up. Passwords are case sensitive. Dates are often written with no separators, as 05081990 rather than 05/08/1990. A space copied from the end of an email counts as a character.

Look for an unlocked copy instead

Often the fastest route is to not open this file at all.

  • Download it again. Some services let you choose whether to password protect the download, or reissue a statement unlocked on request.
  • Find the original. If you made the PDF from a Word document, a spreadsheet or a scan, the source file is not encrypted. Export it again.
  • Check your sent mail. If you sent the file to someone, the attachment in your sent folder may be an earlier, unlocked version.
  • Ask the sender. For anything work related, this is the right answer and it is quicker than any of the others.

If you are going to try guessing

If the file is yours and you have exhausted everything above, guessing is the last option, and it works well only in one situation: when you remember roughly what the password looked like. “It was my dog’s name and a year” narrows the search from impossible to minutes.

Use an established offline tool, run on your own computer. Hashcat, the open source password recovery tool used by security professionals, supports every PDF encryption method, and because it runs locally, the document never leaves your machine.

Be wary of websites offering to “recover” or “crack” a PDF password online. You would be uploading the file, and a file locked with a real open password is almost always one with something worth protecting inside. A site that genuinely removes an open password without it is guessing on its own servers, with your document.

Our tool does not guess. It removes a lock you can already open, and when a file needs a password you do not have, it says so plainly rather than trying.

If this keeps happening

If you lock your own PDFs, keep the password in a password manager at the moment you create it, not afterwards. And ask whether you need an open password at all. If the goal is to stop a file being edited rather than read, a permissions password or a visible watermark does that job without the risk of locking yourself out.

Further reading