Skip to content
AttachKit
Help center

Encrypted and password-protected PDFs in AttachKit, explained

How AttachKit treats password-protected PDFs: permission-protected files unlock automatically on your device, files with a real open password go through the Unlock tool, and in both cases the file and password stay in your browser.

Last updated

Some PDFs are encrypted by the application that produced them. Depending on how they're encrypted, AttachKit either unlocks them automatically on your device or asks you to remove the password first. Either way, the file and any password you type stay in your browser — nothing is uploaded.

Two kinds of PDF protection

TypeWhat it doesWhat AttachKit does
Permissions (owner) password onlyThe file opens without asking for a password but restricts editing, printing, or copyingEditing tools (Fill, Sign, Redact, Pages, Review, Watermark) remove the encryption automatically, on your device
Open (user) passwordA password is required just to open the fileYou need the password — remove it with Unlock

Protected forms that unlock automatically

Many official forms ship permission-encrypted with an empty open password — USCIS forms (I-765, I-130, I-485, N-400, I-90), SSA's SS-5, and plenty of bank statements and pay stubs. They open fine in a viewer, but PDF editing engines refuse to modify them.

When you drop one of these on Fill, Sign, Redact, or the Pages, Review, and Watermark tools, AttachKit detects the encryption and removes it on the spot using qpdf compiled to WebAssembly, running in your browser. You'll see: "Unlocked this protected PDF on your device — nothing was uploaded." No password prompt, no extra step.

One special case: if the unlocked file turns out to be an XFA form (an older Adobe dynamic-form format some agencies use), the message adds a caveat — your changes apply, but you should finalize the form in Acrobat before official submission so its 2D barcode regenerates.

When a PDF needs its password: the Unlock tool

If the file has a real open password, only someone who knows that password can decrypt it — that's the point of the encryption, and AttachKit doesn't try to break it. If you know the password and want a copy without it:

  1. Open Unlock and drop the file.
  2. A card appears: This PDF is password-protected. Type the password you normally use to open the file into the PDF password field.
  3. Click Unlock + download. The decrypted copy downloads with -unlocked added to the name. The password and the file never leave your device.

If you mistype, you'll see "That password didn't open the PDF. Try again." — nothing downloads until the password is right. And to be clear: Unlock removes a password you know; it is not a password cracker and can't recover one you've lost.

Most files unlock losslessly (same document, minus the password). For the rare file where that isn't possible, Unlock falls back to rendering each page as a high-resolution image and tells you so — in that case, run Make searchable afterwards to restore selectable text with on-device OCR.

What other tools show for an encrypted PDF

Tools that can't process an encrypted file disable their action buttons and show a banner along the lines of: "This PDF is encrypted. AttachKit can't read password-protected PDFs. Decrypt with the source PDF first (open in Preview / Acrobat, re-export without a password), then re-drop it here." That's your cue to take the file through Unlock first — or to re-export it without a password from the application that created it. Tools with long-running operations, like OCR, check for encryption up front so you find out before the work starts, not after.

A related but different message — "This file isn't a valid PDF (truncated, corrupted, or wrong file type)" — means the file isn't encrypted at all; it's damaged or isn't really a PDF. Re-download or re-export it from the source.

Putting protection back on

When you're done editing, Protect can put an open password on the finished file, with optional permission restrictions on top — also entirely in your browser.

Not the same as send-for-signature encryption

A PDF password is part of the file itself and travels with it. Separately, when you send a document for signature, AttachKit encrypts it with AES-GCM in your browser before upload, and the key rides in the link rather than on the server — that encryption protects the file in transit and at rest and is removed automatically when the recipient opens their link. See How AttachKit handles your files for the details.

Related

Related

Was this helpful?

Still stuck? Contact support →