PDF says "wrong password"? What to check first

First, what we can and can't do

Unlock PDF removes a password when you type it. It never guesses a password and never tries to break a lock. A PDF locked with a modern lock and a good password can't be opened without that password by anyone, including us. So this post is about checking what you have, not about getting around a lock.

The good news is that "wrong password" is very often a small mistake. Here is a table of the usual causes, and then each one in detail.

Cause 1: a typing difference

Type the password exactly as you were given it, with the same capital and small letters. These are the usual slips:

• Capital and small letters. A password is case sensitive. Check Caps Lock.
• A space. A space at the start or end can come along when you copy from a message. Spaces inside a password work in every kind of lock, so keep them if they are part of it.
• Letters that look alike. A capital I, a small l and the digit 1, or a capital O and zero, look alike in many fonts.
• A phone keyboard that helps too much, by starting with a capital letter or changing a word.
• The wrong keyboard language, so the same keys type other letters.

Use the eye button in the password box to see what you typed. If you copied the password from an email, try typing it by hand, and try pasting it, to see whether one works. Nothing is counted and nothing is locked out, so you can try as many times as you need. A wrong password is said to be wrong in under 0.1 second for a small file and 0.3 seconds for a 47.8 MB scan on our test computer, so you get an answer straight away.

Cause 2: you were given a rule, not the password itself

Banks, card companies, employers and government sites often don't send the password. They tell you how it is made, from details they already have about you, and you build it yourself. If you typed the sentence of the rule, or built it in a slightly different way, the file stays locked.

• Read the whole email, including the small print at the bottom. The rule is often there, not in the first line.
• Check the sender's website or app. Many senders explain the password of their PDFs in their help pages or on the page where you download the file. Look for words like "password to open the PDF".
• Check the order and format of the details, such as whether it uses capital or small letters, how many digits it takes and whether a date is written one way or another.
• Ask the sender. Customer care, your company's HR or payroll team can tell you how the password works, or send the file again without one.

We don't list any bank's or government site's password rule here. Such rules differ between senders and change over time, and a rule copied from somewhere else may be out of date. The sender's own email or website is the place to check.

Cause 3: this file has its own password

Statements from the same sender usually share one password, so Unlock PDF, when you type it once, tries it on every file waiting for a password. But not every file in your folder is a statement from the same sender. A file with a different password keeps its own box, ready for its own password. If one month or one document refuses the password, check whether it came from another sender, another account or another year. The rule may have changed, for example when a customer ID or a date of birth was updated.

Also check that it is the file you think it is. A downloads folder full of similar names makes it easy to pick the wrong one.

Cause 4: a password with letters of another language

Most PDF passwords are English letters and digits, and those always work. A password can also have Hindi, Tamil, Bengali or accented letters. Type it exactly as you were given it, with the same keyboard language. What happens next depends on the kind of lock:

• AES 256-bit stores passwords as Unicode text, so letters of any language work. The standard asks for the text to be tidied first (special spaces become plain spaces, invisible characters are dropped), and not every app does that step, so Unlock PDF tries the password both ways, tidied up and exactly as typed.
• RC4 and AES 128-bit are older locks that store passwords as one byte per letter, and each app turns letters into bytes its own way. Unlock PDF tries the ways PDF apps use. English letters, digits and Western European accented letters are found by all of them. Letters of other languages work when the app that locked the file used UTF-8, the usual way to store any language. Some older apps can't store them at all.

Each of these is only a different way of writing the password you typed, never a guess at another password. In our tests of files locked by qpdf, passwords with Hindi, German and Japanese letters opened AES 256-bit files, and a Hindi password stored as UTF-8 opened an RC4 128-bit file.

Cause 5: there is no password to type

If the page shows no password box, the file may not need one:

• Restrictions only. A file that opens without a password but won't let you print, copy or change it is unlocked at once, with no password needed. The row says what was blocked. PDF password vs restrictions explains the two kinds.
• Not locked at all. The page says so, because there is nothing to remove. If your app showed an error, the problem was something else, perhaps a damaged download.

To tell which kind of lock you have, open the file in any PDF app. If it asks for a password first, it has a password to open. If it opens straight away but Print or Copy doesn't work, it only has restrictions.

Cause 6: a lock with no password to type, or a damaged file

• A lock opened by a certificate, or a reader plug-in, instead of a password. Unlock PDF can't open it, because there is no password to type. Ask the sender for a copy in the usual form.
• A damaged or cut-off file. A download that stopped halfway can give a file that looks like a PDF and isn't. Download it again, or ask for it to be sent again.
• Something other than a PDF with a .pdf name. Open it in a PDF reader to see.

Unlock PDF opens locks made the standard PDF way, with a password: RC4 40-bit and 128-bit, AES 128-bit and AES 256-bit. We tested each kind on files locked by qpdf and by pypdf, two widely used PDF programs, and on a password-locked file made by LibreOffice.

If nothing works: what not to do

Be careful with "password recovery" sites and apps. A site that offers to recover a PDF's password has to get your file to try, and your bank statement or ID document then sits on someone else's computer. Asking the sender is safer and usually quicker. These are better steps:

1. Ask the sender to send the file again, with a password you know, or without one.
2. Download it again from the bank's or the portal's site. Some let you choose a password, or download without one.
3. Check your records. A password you set yourself may be in an old message, a notebook or a password manager.
4. Don't guess your way in. Many senders' passwords use details like a date of birth. Trying many guesses doesn't help if the rule is different from what you think.

If the file is one you locked yourself with Protect PDF, there is no way back: the password isn't stored in the file, and we never saw it. That is why you keep the original, which Protect PDF leaves untouched.

Once it opens

When the right password goes in, the row says what the file was locked with and what was blocked, and you can download an unlocked copy. Its name ends in -unlocked, so your original stays as it was. Every unlocked copy kept its pages, text, links, bookmarks and form answers in our tests. A PDF with a digital signature loses the signature's validity in the unlocked copy, and the row says so: keep the original if it matters.

Then go on with what you needed it for. Merge, shrink or upload a locked PDF covers the next steps, and Remove password from a bank statement PDF has the phone steps. Lock the file again with your own password if you send it to someone else.

Your file and password stay on your device

Unlock PDF has no upload step and never sends your files or passwords anywhere. The password is handed to a background worker on your device and forgotten when the page closes. The page contacts only this site and Google's ad service, which shows the ads that keep the tools free, and our code never gives your files to the ad code. The privacy policy has the details.