Your bank sends statements encrypted with your date of birth. A client sends a locked contract you need to annotate. Your own archive from three years ago is protected with a password you set and no longer remember. All of these are ordinary situations, and the answer differs sharply depending on which kind of password you are facing.
The two passwords, and why the difference matters
PDF encryption defines two distinct passwords, and they behave nothing alike.
The user password (or open password) is required to decrypt and open the file. Without it, the content is genuinely encrypted — modern PDFs use AES-128 or AES-256, and there is no back door. If you do not have this password, you cannot read the document, and no tool can legitimately give you access.
The owner password (or permissions password) does not restrict opening. It sets flags declaring that the document should not be printed, copied, or edited. Here is the part that surprises people: those restrictions are advisory. The file is not protected against the operations — the flags simply ask viewers to disable them, and well-behaved viewers comply. Many tools ignore them entirely. A permissions-only PDF opens for anyone and its restrictions can be cleared trivially.
So: a document you can open but not edit has an owner password, and removing it is easy. A document that demands a password before showing you anything has a user password, and you need that password.
Removing protection from a file you can open
The universal method, working on every platform with no installation:
- Open the PDF in any reader or in your browser, entering the password if prompted.
- Press Ctrl+P (Cmd+P on Mac) to open the print dialogue.
- Choose Save as PDF — or Microsoft Print to PDF on Windows — as the destination.
- Save.
The output is a fresh, unencrypted PDF. Because you have already decrypted the original by opening it, this is not circumvention; it is re-printing a document you have access to.
On macOS there is a cleaner route that preserves quality better: open in Preview, choose File → Export as PDF, expand the security options, and save without a password.
On the command line, qpdf does it losslessly and keeps the document structure intact:
qpdf --decrypt --password=yourpassword input.pdf output.pdf
This is the best method available. Print-to-PDF rasterises or reflows some documents and discards structure; qpdf simply removes the encryption layer.
What print-to-PDF costs you
It is a workaround, not a clean operation, and it has real side effects worth knowing before you use it on something important:
- Interactive form fields become flat pictures of themselves. Anyone who needed to fill them cannot.
- Bookmarks, internal links, and hyperlinks are usually lost.
- Tags and accessibility structure are discarded, which makes the output much worse for screen-reader users.
- File size often grows, sometimes substantially, because text may be re-encoded.
- Text can become non-selectable depending on the driver.
- Digital signatures are invalidated, since the output is a new file.
For a document you just need to sign and return, none of this matters. For a form, an accessible publication, or an archival record, use qpdf instead.
If you do not know the password
If the file needs a password to open and you do not have it, the honest answer is that you cannot read it. AES encryption is not a lock that can be picked with the right tool. Password recovery utilities exist, but what they actually do is guess — dictionary and brute-force attacks — and against a decent password on modern encryption they will not succeed in any useful timeframe.
The realistic options are:
- Ask whoever sent it. Overwhelmingly the fastest route.
- Guess the convention. Institutional senders often use a formula: date of birth as DDMMYYYY, the last four digits of an account number, a national ID number, a postcode. Banks and insurers frequently state the convention in the covering email you skimmed.
- Check your password manager. For your own old files, this is more often successful than people expect.
And a boundary worth stating plainly: removing protection is appropriate on documents you own or have a right to access. Attempting to defeat encryption on someone else's document without authorisation is a different matter, and depending on where you are it may breach computer-misuse legislation, copyright law, or the terms under which the file was shared. This article is about the first case.
Why editors reject protected files
If a PDF opens in your reader but an editor refuses it, one of two things is happening. Either the file still carries encryption — you supplied the user password to the reader, but the editor cannot prompt for it or does not implement that encryption revision — or the owner password's flags declare editing prohibited and the tool is respecting them.
In both cases, producing an unprotected copy by one of the methods above resolves it. Once you have that copy, you can open it in Docento.app to add text, signatures, stamps, and annotations, all processed on your own machine with nothing uploaded. See privacy in browser PDF editing for how that works.
Putting protection back
Once you have finished editing, you may well want the document protected again — particularly if it is going back to a client. How to password protect a PDF covers it, and AES-128 vs AES-256 PDF encryption explains which strength to choose.
A closing note on habits: a password emailed alongside the document it protects provides essentially no security, since anyone reading the mailbox has both. Send the password by a different channel — a text message, a phone call, a password manager's sharing link. How to share a PDF securely covers the rest.
