PDF security guide

📄 Recover protected PDF password

PDF has 2 protection types: "owner password" (limits print/copy) and "user password" (prevents opening). Algorithms range from RC4 40-bit (PDF 1.1, removable in milliseconds) to AES-256 (PDF 1.7+, similar to wallet.dat). This guide explains which version your PDF has and how to recover it.

⚡ Complex case? Professional service /wallet-recovery/ · USD 35 diagnostic, success fee only if we recover.

Identify your PDF version

Security level varies dramatically by PDF version:

PDF Version	Algorithm	Crackable?
1.1-1.3	RC4 40-bit	Yes — ms
1.4-1.5	RC4 128-bit	Hard
1.6	AES-128	Hard
1.7+	AES-256	Like wallet.dat

To identify version: open PDF with any text editor, first line says %PDF-1.X.

Owner password vs User password

Owner password (limits actions like printing, copying text, editing): always crackable. There are free tools (qpdf, pdftk) that remove restrictions regardless of password strength because the encryption has structural flaws.

qpdf --decrypt --password="" input.pdf output.pdf

User password (prevents opening PDF): much more serious. If it's PDF 1.7 with AES-256 + strong key, similar difficulty to wallet.dat.

Hashcat for PDF user password

Hashcat supports several PDF versions:

-m 10400: PDF 1.1-1.3 (rc4 40-bit). Instant crack.
-m 10500: PDF 1.4-1.6 (rc4 128 + aes-128). Wordlist viable.
-m 10600: PDF 1.7 (aes-128 keylen)
-m 10700: PDF 1.7+ (aes-256). Slow.

pdf2john input.pdf > hash.txt

hashcat -m 10700 hash.txt wordlist.txt

RTX 3090 throughput on PDF 1.7 AES-256: ~50,000 a/sec. Full RockYou processes in 5 min.

Viable cases vs impossible

Almost certain recovery:

PDF 1.1-1.5 with any password
PDF 1.7 with password in RockYou
PDF 1.7 with known pattern (name + year, etc.)

Hard recovery:

PDF 1.7 with random 12+ char password
PDF 1.7 with "meaningless" passphrase

Impossible recovery:

PDF 1.7 with random 20+ char password manager output

Qpdf restriction removal (owner password)

For PDFs that open OK but prevent printing or copying text, qpdf removes restrictions in 1 second (FREE, you don't need to know the password):

qpdf --decrypt input.pdf output.pdf

Works because PDF "owner password" has structural flaw: hash stores with predictable XOR, recoverable without brute force.

NEVER pay for service promising "remove print protection" — qpdf is free and does it better than any service.

When professional service justifies

If PDF is worth more than USD 100 and is PDF 1.7 with complex user password, professional service with cluster makes sense. Typical cases: legal contracts, medical documents, architectural plans, out-of-print books, family documentation scans.

Our cluster processes PDF 1.7 AES-256 at ~250,000 attempts/sec combined (5×3090). USD 35 diagnostic tells you real chances before committing to anything bigger.

Frequently asked questions

Do free 'pdf unlocker' online services work?

Only for owner password (which qpdf does better + safer). For strong user password, no — they're scams or only test minimal wordlist.

Difference between Adobe Acrobat and other readers?

Encryption algorithm is standard PDF, not Acrobat-specific. Any reader suffers the same. Encryption is at file level.

Does it work with digitally signed PDFs?

If only signed (without user password), opens normal no problem. If has user password + signature, first recover password. Signature is independent.

How much for critical PDF?

USD 35 diagnostic. Then by complexity: USD 200 (wordlist + simple masks) or USD 2000 (AI Scan + intensive cluster). Pay AI Scan only if case is viable.

What happens to original PDF during process?

Your file uploads encrypted to our private storage. We process in isolated cluster. No third party sees content. Auto-delete 72h post-recovery.

Complex case? We can help

5×RTX 3090 GPU cluster + ML engineer. USD 35 diagnostic, USD 2000 AI Scan, success fee 30-40% only if we recover.

🔐 Wallet Recovery →