How to remove a password from a PDF
The two kinds of PDF protection, which one you are looking at, what can and cannot be removed — and why doing it in your browser is safer than uploading the file to a website.
First, work out which lock you have
Every discussion of “unlocking a PDF” runs into trouble because the format has two entirely different protections and people use one word for both.
1. The document open password
Also called the user password. Without it the file will not open at all — your reader shows a prompt before it shows a single page. The document's content streams are encrypted with a key derived from this password, so without it the bytes are genuinely unreadable. No tool can remove this without knowing the password, and anything advertising otherwise is either brute-forcing (slow, and often futile against AES-256) or lying.
2. Owner restrictions
Also called permissions or the owner password. The file opens normally, but printing, copying text, extracting pages, filling forms or annotating are blocked. Here is the thing worth understanding: the content is encrypted with a key that any reader can already derive without a password, and the restrictions are just flags that compliant readers agree to honour. That is why they can be removed without knowing anything — the lock was always a request, not a barrier.
Removing it
- Open the unlocker and drag your PDF onto the drop area. Nothing is sent anywhere — the page has already downloaded the engine it needs.
- GetPDF inspects the file and tells you which case you are in. Owner restrictions are removed immediately.
- If a document open password is needed, type it. Tick the “try this on every locked file” box when a batch shares one password.
- Download
yourfile-unlocked.pdf. Text, fonts, images, forms, bookmarks and links are all intact.
If you do not have the password
This tool will not guess it, and that is deliberate. What actually works:
- Read the covering email. Banks, insurers, payroll providers and tax portals almost always state the rule alongside the attachment.
- Try the standard patterns. Date of birth as
DDMMYYYY, surname plus birth year, a customer or policy number, a national ID in a specific case. These are conventions, not secrets. - Ask the sender. Faster than anything else, and the only option for a document you did not generate.
- Look for the source. A protected statement is usually re-downloadable from the portal that produced it, and portals often offer an unprotected version.
Why not just upload it to a website?
Because the documents people want to unlock are exactly the documents they should be most careful with. A bank statement contains your account number, balance and transaction history. A payslip has your salary and tax identifiers. A contract may be commercially confidential. Uploading any of those to an unknown server means trusting an operator you cannot audit, a retention policy you cannot verify, and a jurisdiction you may not know.
GetPDF avoids the question entirely. The decryption engine — qpdf, a long-established open-source PDF library — is compiled to WebAssembly and runs in a worker thread in your own tab. You can verify this: open your browser's developer tools, watch the network panel, and unlock a file. After the page and the engine load, nothing further is requested. Disconnect from the internet and it still works.
What we cannot do
- Crack a forgotten open password. By design.
- Remove a digital signature. Decrypting rewrites the file, which invalidates any signature it carried — that is the point of a signature. If the signature matters, keep the original.
- Defeat DRM systems layered on top of PDF. Adobe's protected-content systems are a separate mechanism and are not addressed here.
- Repair a corrupted file. If qpdf cannot parse the structure, the file is damaged rather than locked, and you will be told so.
A note on the law
Removing protection from a document you own or have been authorised to use is ordinary and lawful in most places. Removing it from someone else's confidential or copyrighted material generally is not, and circumventing technical protection measures is specifically regulated in some jurisdictions. You are responsible for having the right to do what you do with this tool.
More questions
Not if it is a document open password — that would mean guessing the key, which this tool deliberately does not do. Your realistic options are to ask whoever sent the file, check whether it follows a documented pattern (banks and payroll systems very often derive it from a date of birth, a PAN or an account number), or look for the original unprotected source.
Most issuers publish the rule in the covering email. Common patterns are a date of birth as DDMMYYYY, the first few letters of a surname joined to a birth year, a customer or account number, or a national ID in a fixed case. Once you know it, unlock the file once here and keep the clean copy.
Yes, and more reliably than before — an unencrypted PDF is the most broadly compatible form of the format. Older readers, mobile viewers and print shops that choke on newer AES-256 encryption will handle the decrypted copy without complaint.
Yes. Scanned documents are just PDFs whose pages contain images, and the encryption layer works the same way. The images are copied across untouched — no recompression, so no extra blurring.
It does, in any modern mobile browser. WebAssembly is well supported on both iOS and Android. Very large files are more likely to run into memory limits on a phone than on a laptop, so if a big scan fails, try it on a desktop.
It is gone. Everything lives in the tab's memory — nothing is written to local storage, no cache, no cookie, no server. Closing or reloading the page discards the queue completely.