You receive a PDF that is locked down tight. You need to enter a password just to view it. After entering the password and opening the file, you discover a second layer of restrictions: you cannot print it, copy text from it, or make any changes. The sender gave you the open password but not the permissions password. You have the right to view the content but not to use it in any meaningful way.
A PDF with both an open password and a permissions password has two separate locks. The Unlock PDF process for this scenario requires handling both locks, using the open password you know to access the content, and then removing the permissions restrictions that prevent you from using it.
Understanding the Two-Password System
The open password, also called the user password, encrypts the PDF content. Without it, the file is a block of encrypted data that cannot be read. Entering the correct open password decrypts the content so you can view it. The permissions password, also called the owner password, controls what you can do with the decrypted content. It sets flags that disable printing, copying, editing, commenting, and other functions.
These two passwords are independent. Knowing the open password lets you view the content but does not give you control over the permissions. Knowing the permissions password lets you change the restrictions but does not let you view the content without the open password. A document with both passwords set requires both to fully unlock. Most recipients only receive the open password from the sender, which is correct for the sender's intent: they want you to view the document but not to modify or extract from it.
How to Remove Permissions When You Know the Open Password
WukongPDF's unlock tool handles the two-password scenario. Upload the PDF. The tool detects that both an open password and a permissions password are present. Enter the open password when prompted. The tool decrypts the content using your password. It then strips the permissions restrictions, resetting all flags to allowed. The output is a PDF that opens without a password and has no restrictions. The permissions password is removed. The open password is also removed because the content is re-saved without encryption.
The quality and resolution of the output are identical to the original because the content is decrypted and re-saved, not re-rendered. Text remains sharp and searchable. Images retain their original quality. The only change is that the password protection and restrictions are gone.
What to Do When You Do Not Know Either Password
If you do not know the open password, the content is encrypted and cannot be read. You cannot view the file, much less remove its restrictions. The only legitimate path is to contact the sender and request the password. Do not attempt to crack the open password using brute-force tools. Modern PDFs use 256-bit AES encryption, which is cryptographically secure against brute-force attacks. If the password is strong and unknown, the file is effectively inaccessible.
If you know the open password but the unlock tool cannot remove the permissions, the PDF may be using a security policy enforced by a server-based digital rights management system rather than a simple password. Server-based DRM ties the document permissions to an online account or a specific device. The permissions cannot be removed by a local tool because they are enforced by a remote server that issues access tokens. These DRM-protected PDFs are typically used for paid content like ebooks, research reports, and training materials. Removing DRM from these documents likely violates the terms of service or copyright law.
Legal and Ethical Considerations for Two-Password PDFs
The sender applied a permissions password for a reason. They wanted you to view the document but not to modify, print, or extract from it. Before removing those permissions, consider whether your intended use is consistent with the sender's intent and with your agreement with the sender.
There are legitimate reasons to remove permissions. You need to print a contract to sign it and the permission to print was accidentally restricted. You need to copy a paragraph to quote in a response document. The sender told you verbally that the restrictions were a mistake and asked you to work around them. These scenarios justify removing the permissions because your use is consistent with what the sender would have allowed had they configured the PDF correctly.
There are also illegitimate reasons. You want to extract content from a paid report to distribute without paying. You want to modify a contract after it was signed to change the terms. You want to remove copy protection from an ebook to share it online. These uses violate the sender's rights and likely the law. The PDF Security tools exist to solve legitimate workflow problems. Using them to circumvent protections on content you do not have the right to use is not what they are for.
A common scenario where two-password PDFs appear: government and legal documents distributed through secure portals. The portal provides the open password for viewing, but retains the permissions password to prevent recipients from extracting or modifying the official record. If you need to use content from such a document in a way the permissions prevent, such as quoting a passage in a legal filing, contact the issuing agency. Most agencies have a process for requesting an unrestricted version for legitimate use. Going through the official process is slower than removing the permissions yourself, but it ensures you have the legal right to use the content in the way you intend.
For documents you create and distribute yourself, avoid the two-password scenario entirely unless you have a specific reason for it. Setting both an open password and a permissions password creates friction for the recipient and generates support requests when they cannot print, copy, or extract the content they legitimately need. A single open password for viewing protection is simpler and sufficient for most use cases. Only add a permissions password when you genuinely need to restrict specific actions by authorized viewers, and communicate clearly to recipients what they are and are not allowed to do with the document.