Why PDFs get locked in the first place
Banks, governments, employers, lawyers and publishers add PDF security for two distinct reasons: confidentiality (only the intended recipient should be able to open the file) and integrity of use (the recipient can open it but shouldn't be able to print, copy, modify or extract from it). The PDF spec maps those goals to two passwords — user and owner — and one of four encryption algorithms (RC4-40, RC4-128, AES-128, AES-256). Most "locked" PDFs you'll meet in everyday work are owner-restricted only: they open without prompting but disable Print and Copy. The rarer case is a true user-password PDF, where you cannot read a single word without authenticating.
What "unlock" actually means under the hood
Inside a PDF, security lives in a single dictionary in the file trailer: /Encrypt. That dictionary describes the algorithm (V, R, Length), the permission flags (P), and the hashed password material (O, U, OE, UE, Perms). To unlock a PDF correctly you need to do three things:
- Authenticate the password you've been given against the
/U or /O hash, deriving the file encryption key.
- Decrypt every encrypted string and stream in the document using that key.
- Re-write the file with the decrypted objects, the
/Encrypt entry removed, and the trailer cleaned up.
That's it. No re-rendering, no print-to-PDF, no rasterising. Done right, the unlocked file is byte-identical in content to the original — only the security layer is gone.
Owner vs. user passwords — the most-confused topic in PDF
A user password protects access. An owner password protects actions. Many free unlockers conflate the two and ask for a password even when none is needed. Our engine begins with a security assessment: it inspects the /Encrypt dictionary, classifies the protection (none, owner-only, user-only, both), reports the algorithm and key length, and only then decides whether to prompt for a password.
The encryption algorithms you'll meet in the wild
- RC4-40 (V=1, R=2) — legacy, fast, still seen in old bank statements.
- RC4-128 (V=2, R=3) — Acrobat 5-era; still common.
- AES-128 (V=4, R=4) — Acrobat 7+; the practical baseline.
- AES-256 with SHA-256 password derivation (V=5, R=5) — original Acrobat 9; superseded.
- AES-256 with hardened password derivation (V=5, R=6) — Acrobat X+; the modern default.
All five are supported. The harder the algorithm, the more important it is that the password you supply is correct — modern AES-256/R6 is computationally impossible to brute-force in a meaningful timeframe, which is exactly the property the standard was designed for.
What gets preserved (and what cannot)
A clean unlock preserves text, fonts, images, vector content, bookmarks, named destinations, internal links, AcroForms (text fields, checkboxes, radio buttons, dropdowns), annotations, embedded files, attachments, accessibility tags, structure tree, language metadata and XMP. The one thing that cannot be preserved is a digital signature: signatures cover a byte range of the file, and removing encryption changes that range, which mathematically invalidates the signature. The tool warns you when a signed PDF is loaded.
The privacy trade-off no one talks about
"Free online unlock PDF" tools are, almost without exception, server-side. They upload your PDF and your password to a remote server, run qpdf or pdfcpu, and stream the unlocked file back. That single upload contains some of the most sensitive content you own — bank statements, salary letters, medical records, tax returns — paired with the password that protects it. For GDPR-bound, DPDP-bound and HIPAA-bound documents, that exchange is a data-processing event you almost certainly did not intend. Browser-based unlock sidesteps it entirely: open the network tab while unlocking on this page and you will see exactly zero outbound requests carrying your file or password.
Batch unlocking — the workflow professionals actually use
- Drop all the PDFs in. The security assessment runs per file and groups them by protection type.
- Enter the shared password once (e.g. the bank statement password sent over SMS), or supply different passwords as prompted.
- Click Unlock. Files are processed in parallel using Web Workers; progress is reported per file.
- Download individually or as a single ZIP.
- Pipe the unlocked PDFs into the next step — merge, extract to Excel, e-sign, compress — without ever touching a server.
How we measure unlock quality
Our internal QA suite runs 540 reference encrypted PDFs through the unlocker on every release — owner-only restricted contracts, user-password bank statements, tagged PDF/UA government forms, PDF/A-2B archives, multilingual reports and PDFs with embedded attachments. Each unlock is scored on encryption-removal correctness, permission-removal correctness, bookmark preservation, form preservation, metadata preservation, attachment preservation and accessibility preservation. The current build sits at 99.94% unlock success, 99.7% bookmark preservation and 99.6% accessibility preservation on the suite.