Password-Protected PDFs: What Browser Tools Can and Can't Do

You drop a PDF into a merge tool and it refuses to load. Or stranger still: the file opens perfectly in your usual reader, no password prompt, nothing unusual — and yet every tool you try says it can't process it. The explanation is that "password-protected" covers two quite different mechanisms, and the confusing case is almost always the second one.

The two kinds of password

A user password (also called an open password) encrypts the document. Without it, the file's contents are genuinely unreadable — not hidden, encrypted. Your reader prompts you before showing anything. This is real protection: without the password there is no document to work with, only ciphertext.

An owner password (also called a permissions password) is different in kind. The file still opens normally for everyone, with no prompt. What it carries is a set of flags declaring what readers should allow — no printing, no copying text, no editing, no extracting pages. The content is often encrypted too, but with a key any reader can derive, so opening works while the restrictions ride along as instructions.

That second one is the source of nearly all the confusion. Nothing in your day-to-day experience of the file suggests it's protected, because your reader is quietly honouring flags you never see.

Why the restriction is a convention, not a wall

Owner-password restrictions work because software agrees to respect them. A well-behaved PDF library reads the permission flags and declines to modify a document whose author said not to. Nothing about the encryption itself enforces this — it's an honour system baked into the format, and one that tools follow because ignoring an author's stated wishes is the wrong default.

This is why you'll find tools online that strip these restrictions. They can, technically. Whether they should depends entirely on whose document it is, which is a question the tool has no way to answer and you do.

What HerePDF does when it meets one

Every tool here runs on pdf-lib inside your browser, and it will decline to load a protected document rather than work around the protection. If you drop an encrypted or restricted file into merge, split, or any other tool, you'll get an error rather than a result.

We haven't built a password-removal tool and don't intend to. Removing a user password requires knowing the password — at which point you can simply re-save the file yourself. Removing an owner password means overriding a restriction someone deliberately applied, and a site whose entire premise is not doing things to your documents behind your back is a poor place to add a feature whose main use is overriding someone else's stated intent.

What to do instead

If it's your own document and you have the password:

• Open it in Adobe Acrobat, macOS Preview, or your PDF reader of choice, and re-save or export a copy without protection. Most readers offer this once the file is unlocked.
• Better still, go back to the source. If it came from Word, a design tool, or an export process, re-export it without the security setting — you'll get a cleaner file than any after-the-fact stripping.
• Printing to PDF from within the unlocked document produces an unprotected copy, though you lose text selectability if your reader rasterises it.

If it's your document and you've lost the password: recover the original source file if one exists. Password recovery on a user-password PDF means brute force, which is slow, often futile, and requires handing your document to whatever tool is doing the guessing.

If it isn't your document: ask whoever sent it for an unrestricted copy. That's not a workaround, it's the correct step — the restriction is a statement about how the author wants the file used.

Diagnosing which one you have

If the file prompts for a password before showing you anything, that's a user password and the document is genuinely encrypted. If it opens straight away but tools reject it, or your reader greys out printing or text selection, that's an owner password. Most readers will tell you outright: look for a "Security" or "Permissions" section in the document properties, which usually lists exactly which operations are disallowed.

A third possibility worth ruling out: the file might not be protected at all, just malformed. PDFs produced by unusual software, or truncated by an interrupted download, can fail to load for reasons that have nothing to do with security. If your reader also complains, or the file size looks wrong, suspect corruption before encryption.