PDF Unlocker

Source: {{ sourceBadge }} Authority: {{ authorized ? 'Confirmed' : 'Required' }} Output: {{ outputReady ? 'Verified' : 'Pending' }}

Locked PDF:

Choose one authorized PDF, or load the safe unencrypted sample to inspect the readiness workflow.

{{ sourceError || 'Drop one PDF onto the source area, or use Browse on keyboard and touch devices.' }}

Password type:

The tool never guesses or recovers passwords.

Known password:

{{ password_kind === 'empty_user' ? 'No password is passed in empty-user restriction mode.' : 'Use only a password supplied by the document owner or source system.' }}

Authorization confirmation:

Required before a decrypt rewrite can run.

Permission note:

This non-secret note appears in the local evidence ledger.

Target filename:

Opening Advanced without changing this blank value is neutral.

Browser work limit:

Default 80 MiB; accepted range 10–200 MiB.

MiB

The chart renderer is unavailable. The same status counts remain in the summary and evidence ledger.

Check	Status	Evidence	Next action	Copy
{{ row.label }}	{{ row.status }}	{{ row.evidence }}	{{ row.action }}

A protected PDF can require a password merely to open, or it can open normally while asking a reader to honor restrictions on printing, copying, or editing. Removing that protection creates a new unencrypted file. It does not discover a forgotten password, prove ownership, or erase the need for permission from the document owner.

The safe use case is narrow: the document belongs to you, you administer it, or you have explicit authority to modify it, and the required credential is already known. Typical reasons include migrating an archive, restoring accessibility, moving an approved document into another workflow, or removing obsolete restrictions from an internal file.

Document open password: A credential needed before a reader can display the document.
Owner or permissions password: A credential associated with changing encryption settings or permissions.
Restriction-only file: A PDF that opens without a prompt but contains standard security restrictions. Some such files use an empty user-password path.

Decryption is a rewrite, not an in-place edit. Keep the original, choose a distinct output name, and open the new copy in a trusted PDF reader before replacing anything. Rewriting a digitally signed PDF can invalidate the signature even when the pages still look unchanged, so signature evidence should send the file to a signing-aware workflow instead.

A structural scan can find a PDF header, an encryption dictionary marker, and common signature markers, but it cannot prove the document is harmless or that every reader will interpret it identically. Treat the resulting copy as a candidate that still needs a normal open-and-review check.

How to Use This Tool:

Prepare one authorized PDF and the credential supplied by its owner or source system.

Choose the Locked PDF, then run Analyze PDF. The source, size, encryption, and signature gates should move out of their waiting state.
Select the matching Password type. Enter the Known password, or choose the restriction-only option when the document opens without a prompt and no password should be passed.
Turn on Authorization confirmation. Add a short non-secret Permission note when an owner request or ticket will help document why the rewrite is allowed.
Run Unlock PDF only when the summary says the gates are ready. Download the copy after Unlocked PDF confirms the PDF header, removed encryption marker, and successful structural check.

Interpreting Results:

Ready to unlock means the six input gates permit a local rewrite. It is not proof that the password will work; the actual decrypt attempt is the credential test. A Verified copy ready result is stronger because the generated bytes start with a PDF header, no longer expose the scanned encryption marker, and pass the PDF consistency check.

Blocked identifies a condition that must be resolved, such as an invalid header, an oversized file, missing authorization, missing password, or signature evidence.
Review means the bounded scan found no encryption marker or the generated copy did not pass every output check. Confirm the reported restriction in another reader before assuming decryption is needed.
A matching page-hint count is useful supporting evidence, but it is not a complete visual comparison. Reopen the downloaded copy and inspect important pages, forms, attachments, and links.

Technical Details:

Standard PDF encryption is described by an encryption dictionary. Decryption uses the supplied credential to read protected objects and writes a separate file without preserving that encryption. Permission flags are reader-enforced policy data rather than a substitute for authorization.

Rule Core

The readiness decision is an ordered set of gates. The rewrite action becomes available only when every required input gate is ready.

PDF unlock readiness rules
Gate	Ready condition	Blocking or review condition
Source	The first bytes contain a PDF header.	A missing or invalid source blocks processing.
Size	File size is greater than zero and no larger than the selected browser limit.	The accepted limit is 10 to 200 MiB; the default is 80 MiB.
Encryption	The bounded structure scan finds an `/Encrypt` marker.	No marker produces a review result rather than an unlock path.
Credential	A password is present when the selected mode requires one.	A missing required password blocks the rewrite. No guessing or recovery is attempted.
Authorization	Explicit confirmation is on for this document.	Unconfirmed authority blocks the rewrite.
Signature	No common signature or timestamp marker is found.	Signature evidence blocks rewriting because it may invalidate the signature.
Output	A copy exists, begins with a PDF header, lacks the scanned encryption marker, and passes the consistency check.	A generated copy that misses any check remains under review.

Transformation Core

The browser first checks the 32-byte header and searches a bounded structural sample for encryption and document features. Files larger than 12 MiB are sampled from both the beginning and end, so the scan is evidence rather than a full semantic parse. After the six input gates pass, the known credential is used to rewrite the PDF locally. The resulting bytes are scanned again and checked for structural consistency before download is enabled.

Changing the password type, password, authorization state, or browser limit invalidates any existing output. This prevents a copy verified under an earlier setup from being mistaken for the current result.

Privacy and Responsible Use:

The selected PDF and password are processed in the browser and are not submitted to a decryption endpoint. The password remains in page memory and is excluded from the evidence ledger, query state, screenshots, and downloads.

Use only documents you own, administer, or have explicit permission to modify.
Do not place the password in the permission note, filename, or exported evidence.
Keep the encrypted original until the unlocked copy has been reopened and checked.
Do not use a rewritten copy as evidence that a digital signature remains valid.

Worked Examples:

Restriction-only internal document

A policy PDF opens normally but printing is restricted, and its owner has approved migration to a new document system. Choose the restriction-only password type, confirm authorization, and analyze the file. If encryption is detected and no signature marker is found, the rewrite can proceed with an empty user password. Reopen the downloaded copy and test both viewing and the action that was previously restricted.

Signed PDF stops before rewrite

A contract has a known open password, but the scan finds a signature or timestamp marker. The signature gate remains blocked even though the other inputs are complete. Keep the original and use a signing-aware process instead of forcing an unlocked copy that would no longer carry trustworthy signature status.

References:

PDF Encryption, QPDF documentation.
Running qpdf, QPDF documentation.