The two kinds of PDF password (and why one barely protects anything)

“Password-protected PDF” describes two very different situations. One kind of password encrypts the document so that nobody without it can read a single word. The other kind lets anyone open and read the file but asks nicely that they not print or copy it. Knowing which one you are dealing with explains almost everything about what can and cannot be done with the file.

The user password: real encryption

The user password (or open password) is the one that matters. When it is set, the document’s contents are encrypted — modern PDFs use AES — and the password is required to decrypt them. Without it, the file is ciphertext. A reader that prompts you for a password before showing anything at all is enforcing a user password.

This is genuine protection. There is no “skip” button, no reader that shows the content anyway, and no tool that removes the password without knowing it. Recovering a well-chosen user password means brute force, which for a strong password is not practical for anyone.

The owner password: a polite request

The owner password (or permissions password) is different in kind, not just in strength. A PDF with only an owner password opens normally — anyone can read it — but carries a set of permission flags: no printing, no copying text, no editing, no filling forms.

Here is the part that surprises people: those flags are instructions to the PDF reader, not encryption of the content. The file’s contents are readable by design — that is the whole point, since anyone may open it. A compliant reader like Adobe Acrobat honours the flags. Software that renders PDFs for other purposes generally never looks at them. The protection is real only for users of well-behaved software, which is why security professionals treat owner-password restrictions as a formality rather than a control. If a document genuinely must not be copied, restricting who can open it at all — a user password, or not distributing the file — is the only mechanism that holds.

How to tell which one a PDF has

• Prompted for a password before anything displays → user password.
• Opens and displays fine, but printing or copying is greyed out → owner password only.
• Both can be set at once, in which case you will see the prompt first and the restrictions after.

Removing a password you know

The everyday case is not an attacker — it is someone whose bank sends statements locked to a card number, or whose payroll PDFs need the same code typed in every single time. Once the file is stored somewhere already protected, the password is friction with no remaining purpose.

Removing it means opening the document with the password — decrypting it — and saving a copy with no encryption applied. The unlock tool here does this in the browser: the password is used locally to decrypt, and never leaves your device, because the whole process runs on your own machine.

One honest caveat about this implementation: the PDF library that can write files cannot decrypt, and the one that decrypts cannot write, so the unlocked copy is rebuilt from rendered pages. It looks and prints identically, but its text layer does not survive — the copy is not searchable. Keep the original alongside it. Tools built on different libraries (such as qpdf on the command line) can preserve the text layer; the trade-off is installing and trusting them with the file.

What no tool can honestly offer

A PDF locked with a user password you do not know is encrypted with a key derived from that password. There is no back door, no recovery service with special access, and no legitimate tool that opens it — anything advertising otherwise is either brute-forcing weak passwords or wasting your time.

If the document is genuinely yours, the practical route is the issuer: banks and payroll providers can re-send documents, and the password for issued documents is usually documented somewhere in their correspondence (commonly a date of birth or card fragment, stated in the covering email).