← All posts

Why does my PDF ask for a password every time I open it?

The statement arrives on the same day every month, and every month you type the same eight characters to read it. Then you close it, open it again ten minutes later to check a figure, and type them again.

Your phone asks. Your laptop asks. The mail app asks before it will show you a preview, and the file sits in the folder with a blank grey thumbnail because even the thumbnailer could not get in. You have ticked every "remember" box you can find and it has changed nothing.

Nothing is broken. The file is encrypted, and a password on an encrypted PDF is not a login — which is the whole reason nothing you have tried has stuck.

Why your reader cannot just remember it

When a website asks for a password, it checks the password against a record and then hands your browser a token that says "this one is fine for the next thirty days". The document is on the server, in the clear, the whole time. The password guarded the door.

A PDF has no server and no door. The password is the key. Every content stream and every string in the file — the text, the drawing instructions, the metadata, the lot — is stored as ciphertext. When you type the password, your reader runs it through a key derivation function, gets the file encryption key, and decrypts each object as it draws it. That key lives in memory and only in memory. Close the window and it is gone, and what is left on disk is exactly the ciphertext you started with.

So there is nothing for a reader to remember on your behalf that would be safe to remember. It could store the password, but it could not change the file: the next application to touch that file starts from zero, because the file itself has not moved an inch. That is why the prompt follows you across devices, and why previews and thumbnails fail — the thumbnailer has no way to ask you anything, so it gives up and draws a grey rectangle.

Some readers will store the password for you locally. Preview on a Mac offers to put it in your keychain, and it works, on that Mac, in that application. Open the same file in a browser, an email client or on your phone and you are typing it again.

The only thing that actually ends the prompt is removing the encryption from the file.

Two passwords, and only one of them is a lock

This is where people get stuck, because a PDF can carry two passwords that do opposite jobs.

The user password — the open password — is the one that produces the key. Without it there is no readable content at all. This is real encryption and it is the one prompting you.

The owner password — the permissions password — does not close the document. A file with only an owner password opens instantly for anyone, and carries flags saying printing or copying is not allowed. Those flags are a request that well-behaved readers honour, not a lock; the content is not withheld from you at any point.

Telling them apart takes a second:

If you want a fact about your own file rather than an inference, our PDF inspector reads it in the browser without uploading anything and tells you whether the document is encrypted. On an encrypted file it will report the page count and page sizes and then say plainly that it cannot read the title or check the text layer, because those are ciphertext until somebody supplies the password. That refusal is the tell.

Making it stop, once

You have the password. You just do not want to keep typing it. The fix is one pass: decrypt the document with the password you already have, keep the decrypted copy, and open that one from now on. It will open with no prompt, in any reader, on any device. The steps, and what the tool's notes tell you afterwards, are in removing a password you already know — one file per run, so a mistyped password fails once rather than forty times.

Two habits are worth adding when the document is one that arrives every month. Rename the copy the moment you have it — statement-2026-07-open.pdf next to the original — which sounds fussy until the month you email the wrong one to someone. And open that copy on your phone as well as your laptop before you file it, because crossing devices without a prompt was the whole point.

The bit nobody tells you: it comes back next month

This fixes the file. It does not fix the sender.

If a bank, a payroll system or a portal generates a freshly encrypted PDF every month, next month's arrives encrypted too, and you unlock that one as well. Nothing done to a file on your disk reaches back into the system that produced it.

Two things are worth trying before you resign yourself to it. First, check whether the sender has a setting: many banks let you turn off emailed statements and download them from the portal instead, and the portal copies are usually not encrypted, because the encryption was there to protect the email in transit rather than the document itself. Second, if the password is derived from something like your date of birth and postcode, it will be the same every month — annoying, but at least scriptable.

That second point cuts both ways, and it is worth knowing about your own documents: an auto-generated password made of things printed on the letter is weak, and the file is only as private as that scheme.

A folder of them at once

If you have three years of statements to get through, do not do it a file at a time in a browser. Our unlock tool takes one document per run on purpose, and there is a better tool for a batch anyway.

qpdf is free, installs on every platform, and never touches the internet:

pdftk in.pdf input_pw SECRET output out.pdf does the same if you already have pdftk. Either is the right answer when the passwords must not leave your machine: our tool decrypts on our server, so the password is sent with the job, which is fine for a statement you have already emailed to yourself and not fine for everything.

If you do not know the password

Then this is a wall, and it is worth being straight about why.

There is no lock to pick. The content is ciphertext keyed on the password, so without it there is nothing to open — only bytes to guess at. Our tool asks for the password because it genuinely cannot proceed without one, not as a formality, and it will tell you that the password did not work rather than pretending. No web tool that says otherwise is doing anything cleverer than guessing.

Recovery software exists and does sometimes succeed, but read what it is actually doing: it is trying millions of candidate passwords, and it wins on weak ones — a date of birth, a postcode, a four-digit PIN. Against a real password it does not win. If the document is yours and the sender still has it, asking them is faster than anything else on this page.

If you are the one adding the password

Worth a paragraph, because half the people reading this will be on the other side next week.

Password protect PDF sets both passwords, and there is one trap in leaving the second one blank: fill in the opening password alone and your recipients can lift the restrictions as easily as you set them. Putting a password back on spells out why, and what to set instead.

And if the reason you were reaching for a password was to stop someone changing a filled-in form, encryption is the wrong instrument. Flatten PDF turns the answers into part of the page itself, so there is no field left to type in and no password for anyone to lose — which is usually what people actually wanted.

A password that everyone has to type every time is not security. It is a habit the sender gave you, and you are allowed to end it on your own copy.

Tools this post uses: