How it works

No magic, no uploading your documents to a mystery server. Here is exactly what happens.

1. Your PDF stays on your device

When you drop a PDF in, your browser reads it locally with the standard FileReader API. PDFKeyFinder only looks at the small encryption dictionary stored inside every protected PDF — a few hundred bytes containing values named /O, /U, /P, /R and the file ID. The document content is never read, never uploaded, and never leaves the page.

2. How a password is tested

A protected PDF stores a 16-byte fingerprint (the /U value) that was created from the real password when the file was locked. To test a guess, the tool runs the exact algorithm from the PDF specification (ISO 32000, the "Standard Security Handler"):

guess → pad to 32 bytes → MD5 (×51) → encryption key → RC4 (×20) → 16-byte fingerprint

If the fingerprint produced from the guess equals the one stored in the PDF, the guess is the password. It's pure arithmetic — that's why it runs at thousands of tries per second without opening the file.

3. Which passwords it tries

Smart guesses. Many protected PDFs — especially bank and government statements — use a person's name combined with their date of birth. Enter the name and DOB and the tool builds thousands of realistic combinations (first name + DDMM, initials + year, and so on).

Custom pattern. If you know the shape of the password, build it from segments: e.g. 4 letters A–Z followed by 4 digits from the date. The tool tries every combination that matches the shape.

4. What it can and cannot do

PDFKeyFinder recovers passwords that follow a guessable pattern. It supports RC4 40/128-bit encryption (revisions 2–4). It cannot break AES-256 (revision 5–6) and cannot magically reverse a long, random password — no tool can. Blindly brute-forcing a random 10-character password would take longer than a human lifetime, which is why a name, date, or known pattern matters.

5. Privacy by design

Because everything runs in your browser, there is nothing to leak: no file storage, no queue, no server-side processing. The only thing our server ever records is an anonymous +1 to a "recovered" or "failed" counter so we can show a success rate. See our privacy page.

Try it now