Can this unlock a PDF when I do not know the password?

No, and neither can anything else that runs in a browser tab. The tool decrypts using the password you supply; there is no guessing, no brute forcing and no bypass. A current PDF uses AES-256 with a proper key derivation function, so a genuinely unknown strong password is not recoverable in any useful amount of time by any tool at any price.

Why do I upload the password as a second file?

This site's option schema only offers dropdowns, numbers and checkboxes, with no free-text field of any kind, so the password rides in as a second uploaded file. It is the same arrangement sign-pdf uses for a signature image and fill-pdf-form uses for its field values. Only the first non-blank line of the .txt is read, trimmed, so the newline your editor adds at the end never becomes part of the password.

The PDF has both a user password and an owner password. Which do I supply?

Whichever one you have that opens the file, since qpdf only needs a password that lets it decrypt. If your PDF opens with no prompt at all but blocks printing or copying, it carries owner-only restrictions and you still have to supply that owner password as text, because an empty password file is rejected before qpdf is ever loaded.

Nothing downloaded. Was the password wrong, or is the file broken?

The error message distinguishes them. qpdf exits with the same code either way, so the tool reads its log output and reports "Incorrect password" or "This does not look like a valid PDF file" accordingly. On any failure qpdf writes no output file at all, which is why you never end up holding a half-decrypted PDF.

Does unlocking re-render the pages or reduce quality?

No. qpdf rewrites the document structure without its encryption dictionary and leaves the page contents alone, so text stays selectable text, vector art stays vector and nothing is rasterised. Page count, fonts, images and layout come out identical, and the file arrives named after your original with `-unlocked` appended.

Will a digital signature on the PDF still validate afterwards?

No. Decryption rewrites the file's objects, and a cryptographic signature that covered the previous byte layout will report as invalid in a viewer afterwards. That is inherent to removing encryption rather than a limitation of this tool, so keep the signed original if the signature is the part that matters legally.

Unlock PDF Online Free, Remove Password, No Upload

Remove password protection from a PDF you own by entering its current password, right in your browser. Free, private, no upload, no account.

🔒 Private by design: your files are processed locally in your browser and never uploaded to any server.

User password, owner password, and which one you actually have

PDF encryption has two passwords, and knowing which one you are holding explains most of the confusion around unlocking. The user password (the spec calls it that; every viewer calls it the open password) gates decryption itself. Without it, the file’s content streams are unreadable ciphertext and nothing can display them. The owner password gates permissions instead: printing, extracting text, editing, filling forms, adding annotations.

A file can carry both, or only an owner password. That second case is the one people find maddening. The document opens with no prompt, so it does not feel locked, yet Print is greyed out and text will not copy. That is because the PDF was encrypted with an empty user password and a real owner password, and your viewer is politely honouring flags it has no obligation to honour.

This tool decrypts, which means it needs a password that unlocks the file. Supply the user password if you have it, or the owner password if that is what you were given. There is one honest limitation to flag: because the password arrives as text inside a file, and a blank file is rejected up front, you cannot process an owner-restricted PDF by supplying nothing at all. You need the actual owner password written down.

Why the password arrives as a .txt file

Every tool on this site is configured from a small schema that supports selects, numbers and checkboxes. There is no free-text field in it, let alone a masked password field, and adding one for a single tool would mean a bespoke shell.

So unlock-pdf reuses a pattern that already existed here: the second uploaded file carries the free-form input. Sign PDF takes a signature image that way, and Fill PDF Form takes a JSON file of field values. Here you upload two files, and the tool sorts them by extension rather than by order, so it genuinely does not matter which you drop first. It insists on exactly one .pdf and exactly one .txt, and if it gets a different count it tells you the count it found rather than failing vaguely.

Only the first non-blank line of the text file is used, and it is trimmed. That is deliberate: echo and most editors append a newline, and a trailing \n silently glued onto your password would produce an “incorrect password” error you could stare at for ten minutes. The trade-off is that a password with meaningful leading or trailing spaces cannot be expressed this way.

Unlocking a file

Open Notepad, TextEdit or any editor, type the PDF’s password on the first line, and save it as password.txt.
Drop both the locked PDF and password.txt into the box above, together or one after the other.
Click Unlock a PDF. The result downloads as your original name with -unlocked.pdf on the end.

Delete the text file afterwards. It is a plaintext copy of a password sitting in your downloads folder, which is not where it belongs.

What qpdf actually does to the file

The engine here is qpdf, a long-established open-source tool for reading and rewriting PDF structure, compiled to WebAssembly. It runs the --decrypt operation, which fully re-serialises the document with the /Encrypt dictionary removed. The output is not a PDF whose password has been hidden or blanked; it is a PDF that was never encrypted in the first place, as far as any future reader is concerned. RC4 and AES, both 128 and 256 bit, all decrypt the same way.

Because it operates on the object graph rather than on rendered pages, nothing is redrawn. This is the significant difference between unlocking and the print-to-PDF workaround people reach for: printing flattens a document into images or re-laid-out text, loses selectable content and often inflates the file, whereas --decrypt leaves the pages byte-identical inside a new container. If the unlocked file feels larger than you expected afterwards, Compress PDF is the follow-up, not a reason to distrust the unlock.

The JavaScript glue for qpdf ships with the page and the WebAssembly binary itself is fetched from unpkg, pinned to an exact version, on every unlock. There is no module singleton here, unlike the video tools, so it is your browser cache rather than the page that stops the second fetch.

Reading the error messages

Building this turned up a detail worth documenting, because it changes what the tool can tell you. qpdf exits with code 2 for a wrong password and also with code 2 for a file that is not a PDF at all. The exit code alone is useless for diagnosis; the log text is what separates the two cases. So the tool captures qpdf’s own output and matches on it, turning invalid password into a clear “Incorrect password” and can't find PDF header or can't find startxref into “This does not look like a valid PDF file.”

Capturing that output was not straightforward either. This particular Emscripten build ignores the standard print and printErr module hooks entirely, and writes everything to console.log and console.error instead. The tool therefore swaps those two functions out for the duration of the run and restores them afterwards. Inelegant, and the only way to read the message that tells you your password was wrong.

Two more messages you might hit: an empty text file produces “The password file is empty” before qpdf loads at all, and an already-unencrypted PDF has nothing for qpdf to remove, so the run simply rewrites it.

Neither the document nor its password crosses the network

A password-protected PDF is, by the fact that someone bothered to lock it, near the top of the sensitivity scale: tax returns, payslips, bank statements, medical results, signed contracts. Uploading one to a server-side unlocker means handing a stranger the confidential document and the key to it in the same request, and trusting that both are discarded.

Here the two files are read into the tab’s memory, qpdf decrypts them there, and the result goes to your downloads folder. Neither the PDF nor the password is transmitted, logged or retained, and there is no upload step to opt out of. There is also no page cap or size tier, since your own machine is doing the work; a several-hundred-page document is bounded only by available memory.

What this tool will not do

It will not recover a forgotten password, and it will not remove DRM from a commercially distributed book. It cannot help with a corrupt file that happens to also be encrypted, since qpdf needs a readable cross-reference table before it can decrypt anything. And it is not the tool for adding protection: for that, go the other way and set a password on a document you are about to send.

Unlock a PDF