Encryption is the machinery that makes a PDF's Document Open password meaningful. Without it, a "password" would be a flimsy suggestion any tool could ignore. With it, the file's contents are mathematically scrambled so that only someone with the right key can read them. Understanding the three encryption schemes PDFs use, and how to tell them apart, explains why some locks are trivial to clear and others genuinely cannot be broken.
The three encryption schemes you'll meet
Over the years the PDF standard has used three main algorithms. They roughly track the age of the software that produced the file:
| Scheme | Introduced with | Strength today |
|---|---|---|
| RC4 40-bit | Acrobat 3–4 (late 1990s) | Weak, recoverable with modern hardware. Legacy files only. |
| RC4 128-bit | Acrobat 5–8 | Aging. The cipher has known weaknesses; strength leans on password quality. |
| AES-128 | Acrobat 9 / PDF 1.6–1.7 | Strong. No practical shortcut; security rests on the password. |
| AES-256 | Acrobat X / PDF 2.0 | Very strong. The current standard for confidential documents. |
The jump from RC4 to AES matters. RC4 is a stream cipher with documented weaknesses; the 40-bit variant in particular has such a small key space that it can be brute-forced. AES (Advanced Encryption Standard) is the same family of encryption used to protect banking and government data, and there is no known practical attack against a properly chosen key.
How to check which encryption a file uses
If you have Adobe Acrobat (Reader or Pro), the fastest way to inspect a file is:
- Open the PDF.
- Choose File → Properties (or press Ctrl/Cmd + D).
- Click the Security tab.
- Read the Security Method and Encryption Level lines, they name the algorithm and key size.
The same panel lists which permissions (printing, copying, editing) are currently allowed or denied, which is a quick way to confirm whether you're dealing with an owner-password restriction or a full Document Open lock. Free viewers like Chrome and Edge don't expose this detail, so Acrobat, or a desktop tool that reports the encryption dictionary, is the reliable route.
Why a strong Open password cannot be bypassed
When a Document Open password protects a file with AES-128 or AES-256, the actual page content is encrypted with a key derived from that password. No password, no key; no key, no readable content. There is no "back door" flag to flip, the bytes on disk are genuinely scrambled. The only theoretical attack is to guess the password, and a strong passphrase pushes that from "hours" to "longer than the age of the universe."
This is exactly why any tool claiming to instantly "crack" an unknown Open password on a modern PDF should be treated with suspicion. What such tools can sometimes do is run a dictionary or brute-force attack that only succeeds against weak passwords, and doing that to a file you don't own is a different matter entirely.
The security takeaway
Strong PDF encryption isn't an obstacle to be resented, it's the feature that lets you send a confidential contract, medical record, or financial statement by email with confidence. The same math that stops a stranger reading your protected file is what stops anyone reading theirs. When you need that protection, our guide on how to password-protect a PDF walks through adding it. When you're simply reclaiming a restricted file you own, the permissions explainer covers the easy path.