Every month my bank emails me a statement as a password-protected PDF. That’s fine until I need to do something with it: forward it to whoever files my taxes, attach three months of them to a loan application, or merge them into one file. At that point the password is in the way, and every “remove PDF password” site I found wanted me to upload the statement first.
A bank statement is about the last file I want sitting on someone else’s server. So here’s what I actually do now, plus the built-in options and the one thing none of them will do.
First, figure out which kind of password it is
PDFs have two different passwords, and they behave very differently.
- Open password (the spec calls it the user password). The file won’t show a single page until you type it. Bank statements are almost always this kind. The password format is usually explained in the email itself.
- Owner password (permissions). The file opens fine, but printing, copying text or editing is greyed out. You don’t need to know this password to read the file, and clearing the restrictions doesn’t need it either.
Quick test: double-click the file. If a password box appears before you see anything, it’s an open password. If it opens but you can’t print or select text, it’s owner restrictions only. Some files have both.
This matters because “removing the password” really means writing a new copy of the file without its encryption. To do that for an open-password file, you need the password. There’s no trick around that for a modern file, which brings me to the warning.
Sites that “recover” passwords are guessing
If a site offers to remove a password you don’t know, it is running guesses against the file. Current PDFs are encrypted with AES, and a password that isn’t trivially short isn’t going to fall to a free web tool. You’d be handing over the file for nothing. If you’ve lost the password, ask the bank to resend the statement or tell you the format again.
Option 1: the browser’s print dialog
The quickest built-in route: open the PDF in Chrome or Edge, type the password, then Print and choose “Save as PDF” as the printer. The saved copy has no password.
The catch is that this re-prints the document rather than copying it. Links, bookmarks and form fields can get lost, and the file size can change a lot. If the PDF has a “no printing” restriction, the print route may be blocked. For a plain statement it’s usually good enough.
On a Mac, Preview can do something similar: open the file with the password, then File > Export as PDF and save a copy. If the copy still asks for a password, look at the encryption or permissions option in that export dialog before saving.
Option 2: qpdf, if you have a terminal
If you’re comfortable on the command line, qpdf does this properly. It rewrites the file without encryption and doesn’t re-render anything.
# put the password on the first line of a file so it stays out of shell history
echo 'YOURPASSWORD' > pw.txt
qpdf --decrypt --password-file=pw.txt statement.pdf statement-clear.pdf
rm pw.txt
# check the result
qpdf --show-encryption statement-clear.pdf
# -> File is not encrypted
For an owner-only file you don’t need a password at all:
qpdf --decrypt restricted.pdf restricted-clear.pdf
--password-file is in current qpdf releases. If your version is old and doesn’t have it, --password=... works too, but then the password lands in your shell history.
Option 3: a browser tool that never sends the file
Not everyone has qpdf, and installing it on a work laptop isn’t always possible. I wanted the qpdf behaviour on any machine with a browser, so I built a page for it: Remove a PDF password you know. The file is read by JavaScript inside the tab and the clear copy is written back to your downloads. Nothing goes to a server. (Disclosure: I make ToolOcean, so weigh that.)
How it works in practice:
- Choose the PDF. Before anything is written, the page reports whether the file has no encryption, owner restrictions only, or needs an open password.
- If it needs a password, type it once and press Remove password. A wrong password is one error and stops there. There’s no retry loop and no guessing, on purpose.
- A copy named with
-unlockeddownloads. It opens without a prompt.
You don’t have to take the “nothing is uploaded” line on trust. Open DevTools, go to the Network tab, clear it, then run the tool and look for any request the size of your file. Or load the page, turn on airplane mode, and use it offline.
Things it won’t do, so you’re not surprised:
- It won’t find a password you don’t have.
- Certificate-based PDF security (the kind tied to a digital ID) isn’t supported and will fail with an error.
- It keeps the title and author fields. Removing the password and removing metadata are separate jobs.
- If the file had a certified digital signature, rewriting it breaks that signature. Keep the original if the signature is what matters.
After the password is gone
The clear copy is now a plain file. Anyone who gets it can read it. A few habits I’ve settled on:
- Keep the original encrypted statement as your archive copy, and treat the clear one as temporary.
- Don’t leave clear copies in a synced Downloads folder that half your devices can see.
- If you have to email it to someone, put your own password on it and send the password by a different channel (a message, a call). An encrypted PDF sent with its password in the same email protects nothing.
The gotcha that sent me down this path
I was merging statements and the merge step kept saying one file was “encrypted”, even though it opened without asking for anything. That file had owner restrictions only. The merge tool I was using refused any file with an encryption dictionary, restrictions included. Clearing owner restrictions needs no password at all: run qpdf --decrypt on it, or drop it on the page above, and the merge goes through.
Drafted with AI help, tested and checked by me.