How to Unlock Password-Protected PDFs for Editing (2026 Guide)

Two questions decide everything here, and they have completely different answers. Can you open the file at all? If yes, the restrictions on it are trivially removable and always have been. If no, and you do not have the password, then with a decent password nothing short of guessing it will get you in, and every service promising otherwise is either exploiting a weak password or lying.

The two passwords, and why one is much weaker

PDF's standard security handler has two passwords and they do different jobs.

The user password is the one you type to open the document. The file's encryption key is derived from it, so without it the content is genuinely inaccessible.

The owner password controls a set of permission flags: may the reader print, copy text, extract pages, fill forms, modify the document. A file can carry these restrictions with no user password at all, which is the common case for a report you can open and read but not copy from.

Here is the part that explains everything else. When there is no user password, the user password is the empty string, and the encryption key is derived from it. So the file is fully decryptable by anyone, immediately, with no guessing involved. The permission flags are not enforced by cryptography. They are a request, written in the file, that conforming readers are expected to honour. Adobe Acrobat honours them. Plenty of other software does not. qpdf --decrypt will strip them in a second, and that is not a security exploit; it is the format working as designed.

The practical upshot: permission-only protection prevents nothing. If you need a document not to be readable, you need a user password. If you set permission flags expecting them to stop anybody who can open the file, they will not.

If the file opens but is restricted

You can remove the restrictions. In rough order of convenience:

• qpdf, free and reliable: qpdf --decrypt input.pdf output.pdf. This rewrites the file without encryption and without touching the page content, so nothing is re-rendered and nothing degrades. It is the correct tool for this job.
• LibreOffice Draw can often open such a file and export it without restrictions, at the cost of re-rendering the whole document, so check the output against the original.
• Print to PDF, which works only if your reader lets you print. A reader that honours the flags will grey out printing; one that ignores them will not. Either way it re-renders every page, so text may stop being selectable and links will be lost. Treat it as a last resort rather than a tip.
• Acrobat, if you have the owner password: File, Properties, Security, set the security method to none.

Our own tools are not the answer for this case. The unlock tool asks for a password, so it is built for the encrypted case, and it cannot help you with a file that opens freely but is restricted. Use qpdf.

If you know the password

This is straightforward and every route works.

1. Our unlock tool. Open the unlock tool, add the protected PDF, enter its password when prompted, and download a copy with the protection removed. It runs in the browser, so neither the document nor the password is transmitted anywhere, which is the point of doing it this way rather than on a website that asks you to upload both.
2. Acrobat. Open the file with the password, then File, Properties, Security, and set the security method to no security. Save.
3. qpdf. qpdf --password=yourpassword --decrypt input.pdf output.pdf. The most predictable option if you have several files to do.

Print to PDF also produces an unprotected copy, and it is the worst of the four because it re-renders the document. Use it only if the others are unavailable.

If you have forgotten it

Let us be direct, because a lot of pages on this topic are not. If a PDF has a user password and you do not know it, you cannot open it, and therefore you cannot print it to PDF, convert it, or feed it to any tool. Advice recommending print-to-PDF for a forgotten password is simply wrong: that method requires the file to be open already.

What remains is guessing the password, which recovery software does by trying candidates very quickly. That succeeds or fails entirely on the basis of the password itself. A dictionary word, a name with a year after it, or anything from a list of common passwords will fall quickly. A long random passphrase will not fall at all, and no amount of computing changes that.

So the realistic options are: ask whoever sent you the file, look for the password in the email that delivered it, check whether the same password was used on other files, or, if you set it yourself, check your password manager. If it was important and it is gone, it is gone.

What actually determines how strong the protection is

Not the cipher. The password, and the key derivation behind it.

Older PDF encryption, the revision 4 generation that uses AES-128, derives the file key from your password with an MD5-based function and a small number of iterations. That is fast, which means an attacker can test an enormous number of candidate passwords per second. The AES-256 generation, revision 6, uses a hardened SHA-256 based derivation that is deliberately slower to compute, so the same guessing attack proceeds far more slowly.

Two conclusions follow. With a strong password, both are fine. With a weak password, neither is, and the AES-128 file falls considerably faster. If you are protecting something that matters, the passphrase is the variable to spend effort on.

Which brings us to a disclosure about our own protect tool. It applies the standard security handler with AES-128, which is real encryption and will genuinely keep out anyone without the password. But it sets the owner password to the same value as the user password. Since the permission flags are only ever advisory, and since anyone who can open the file now also holds the owner password, the printing and copying switches in our interface do not restrict a determined recipient at all. Treat our protection as "people without the password cannot read this", which it does well, and not as "people with the password cannot print this", which it does not do.

One more practical point that defeats more encryption than any cryptanalysis: do not send the password in a second email. Both messages sit in the same mailbox, so anyone with access to the mailbox has both. Use a different channel, or accept that you have not really protected anything.

Legal considerations

Removing protection from a document you created, or one you have been given permission to modify, is not a problem. Two areas need more care than the usual "only unlock what you own" advice suggests:

• Commercially licensed material. In the United States and in many other jurisdictions there are anti-circumvention provisions that make bypassing a technological protection measure on a copyrighted work unlawful in itself, separately from any question of whether you then copied anything. Removing the protection from a purchased ebook or a licensed research report can therefore be a problem even if your intended use of the content would have been fine.
• Work documents. A password may have been applied precisely to satisfy a contractual or regulatory obligation, and removing it can breach that obligation even where you hold the password and the document is nominally yours. Check the policy rather than assuming authorship settles it.

None of this is legal advice, and where a document matters, ask someone qualified rather than a PDF article.

Frequently Asked Questions

Related Resources

• Unlock PDF — Remove a password you know, locally
• Remove PDF Password Guide
• Add Password to PDF — Protect your documents
• PDF Security Guide