Browser-based PDF Password Removal — How Decryption Works

1PDF Encryption at a Glance

PDF security is implemented by the Standard Security Handler. All encryption information lives in the file's Encryption Dictionary, referenced by /Encrypt <obj> 0 R in the trailer.

Encryption only affects two kinds of content:

• Streams: page content, fonts, images, etc. (filter chosen by /StmF)
• Strings: bookmark titles, document info, URIs, etc. (chosen by /StrF)

Decryption must solve two problems:

1. File Key: derived from the user password (empty in our case) plus the encryption dictionary;
2. Object Key: each object (by object number + generation number) derives its own key from the file key, so that one key is never used directly for everything.

2PDF Version → Encryption Method Map

• /V (algorithm version) selects the key derivation and cipher family; /R (revision) selects the password-check details;
• RC4-40's "40-bit" key is really 5 bytes (Length 40); RC4-128 is 16 bytes;
• "low security" = R5 (key = a single SHA-256); "high security" = R6 (PBKDF2-style iterated hashing, brute-force resistant).

3Key Fields of the Encryption Dictionary

4The Decryption Pipeline

4.1 Parsing the encryption dictionary

Find /Encrypt <N> 0 R in the trailer, read the dictionary at the object offset, and extract by regex:

• Cipher family: /V, /R, /CFM (/V2 → RC4, /AESV2 → AES-128, /AESV3 → AES-256)
• Key parameters: /Length, /P, /O, /U, /UE (V5)
• String encryption switch: /StrF (missing or /Identity means strings are not encrypted)

/O, /U and /UE may be either hex strings (<...>) or literal strings ((...)); the latter require unescaping (\(, \), \\, octal \ddd, etc.).

4.2 File key derivation

V1–V4 (classic encryption, Algorithm 2)

key = MD5( password(empty) + O[0:32] + P(4-byte little-endian) + ID[0] )
if R >= 3: repeat 50 times: key = MD5(key + first 3 bytes)
take the first n bytes (n = Length/8; n capped at 16)

Note: for AES-128 (V4) with /EncryptMetadata false, append 4 extra bytes FF FF FF FF to the input. ID[0] comes from the trailer's /ID and participates in key derivation, so changing any byte of the file changes the key.

V5 (Algorithm 2.B)

• R5: key = SHA-256( password + U[32:40] + U[40:48] ) (a single hash — fast but brute-forceable)
• R6: iterated hashing, equivalent to a strong PBKDF2:

hash = SHA-256( password + salt + udata )
count = 0
loop:
  count++
  k1 = password + hash + udata
  e  = AES-128-CBC encrypt( key=hash[0:16], IV=hash[16:32], data=k1 repeated 64 times, no padding )
  sel = (e[0]+...+e[15]) % 3            # picks the hash for this round
  hash = SHA-256 / SHA-384 / SHA-512 ( e )
  stop when count ≥ 64 and e[last] ≤ count-32
key = hash[0:32]

R6's stop condition and rotating hashes mean each derivation performs thousands of AES block encryptions and hashes. This is exactly why it is "high security" and brute-force resistant — and a major source of the tool's processing time.

4.3 Password validation (can we open it?)

• V1–V4 (Algorithm 6): compute MD5(empty + padding + ID[0]), then run 20 RC4 iterations with an incrementing index byte, and compare with /U. A match means the file opens with an empty password (the range this tool handles).
• V5 (Algorithm 11):
  • check U[0:32] == SHA-256( empty + U[32:40] );
  • tmpKey = SHA-256( empty + U[40:48] );
  • file key = AES-256-CBC decrypt(key=tmpKey, IV=zero, ciphertext=/UE, no padding).

This step also finalises the file key (cross-checked byte-for-byte against pypdf for R5/R6 in the implementation).

4.4 Per-object key derivation (Algorithms 1 / 3)

Each object builds a salt from object number (3 bytes LE) + generation number (2 bytes LE):

RC4-40 key selection was a recent fix: a single wrong derivation breaks every stream. The implementation uses "content validation + primary/fallback adaptation": it decrypts with the spec key first, and if the content check fails (the result is not valid FlateDecode/image data) it retries with the MD5 fallback key, letting string decryption follow the same conclusion.

4.5 Stream decryption and content validation

• RC4: length-preserving. Since there is no integrity check, content validation is mandatory: the result must be a valid FlateDecode header (78 9C, etc.) or a valid image encoding (JPX must start with FF 4F FF 51); otherwise the stream is treated as unencrypted and left as-is.
• AES-128: CBC + PKCS#7 padding via the browser Web Crypto API (crypto.subtle). Decryption shortens data, so the tool decrypts in descending object order and rebuilds byte-by-byte, shifting following bytes and xref offsets accordingly.
• AES-256 (V5): object key = file key; AES-256-CBC + PKCS#7. A 16-byte random IV is embedded at the head of the stream.

4.6 String decryption

Strings are encrypted only under "classic encryption (V<4)" or when the dictionary explicitly sets /StrF to something other than /Identity (otherwise they are skipped — which is why some files keep intact bookmarks). Ciphertext comes in two forms:

• Literal strings (...): with AES, IV + ciphertext is concatenated; after decryption the result is re-escaped into a safe literal; with RC4, decryption is length-preserving;
• Hex strings <...>: decrypted by the same rules and written back as hex.

The decrypted result must keep byte/text length consistency, and scanning continues after each replacement (adapting to shifted offsets).

4.7 Rebuilding the output

• Remove the /Encrypt reference from the trailer;
• Keep and fix the xref table/stream (object offsets are shifted by the decryption-induced length changes);
• Both classic xref tables and xref streams are supported;
• The rebuilt PDF is no longer marked encrypted and opens, edits, prints and copies normally.

5Per-method Implementation Matrix

Note: R6 iteration and /UE decryption require AES-CBC without padding, which Web Crypto does not provide. The core therefore ships a pure-JS AES block implementation (SBOX / key schedule / CBC chaining, verified against NIST test vectors) — the key to being a single self-contained file.

6Scope and Boundaries

SUPPORTED

• PDFs with an empty user password and only Owner restrictions (openable but edit/print/copy forbidden);
• All five encryption methods: RC4-40, RC4-128, AES-128, AES-256 (R5/R6);
• Classic xref tables and xref streams.

NOT SUPPORTED / REJECTED

• PDFs that require an open password (non-empty user password) — the tool tells you to open them with the password first;
• Files using a non-standard security handler (proprietary third-party encryption).

PRIVACY All logic runs in local browser JavaScript; files never leave your machine and are never uploaded.

7How It Was Verified

• NIST test vectors: the pure-JS AES-128/256 block encrypt/decrypt matches the standard vectors;
• File key cross-check: derived file keys match pypdf byte-for-byte (RC4 / AES-128 / R5 / R6 all identical);
• End-to-end output check: unlocked samples rendered with PyMuPDF are pixel-identical to the original unencrypted reference pages; bookmarks and Chinese metadata are fully restored (both literal and hex string forms verified);
• Boundary tests: files with a user password are correctly rejected.