Linux / FreeBSD: PDFCrack A Command Line Password Recovery Tool For PDF Files

I already written about howto remove a password from all PDF files under Ubuntu or any other Linux distribution in a batch mode. However, many user want a simple command to recover password from pdf files. This is useful if you forgotten your password for pdf file. It is also useful for data-archaeologists, computer forensics professionals, people who want to test their password-strength (pdf files generated by webpass) and many more.

Is pdfcrack illegal to use?

It depends on where you live, but probably not as long as you only use it for documents that you have owners permission to use it on. The only supported usage of PDFCrack is, and will be, to recover passwords and/or content that you own but have lost access to. See resources section for more information.

Install pdfcrack

You need to use pdfcrack which is tool for PDF files password cracker under Linux operating systems. Type the following apt-get command to install it:
$ sudo apt-get install pdfcrack
Sample outputs:

Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  pdfcrack
0 upgraded, 1 newly installed, 0 to remove and 7 not upgraded.
Need to get 0 B/24.9 kB of archives.
After this operation, 61.4 kB of additional disk space will be used.
Selecting previously deselected package pdfcrack.
(Reading database ... 206932 files and directories currently installed.)
Unpacking pdfcrack (from .../pdfcrack_0.11-1_amd64.deb) ...
Processing triggers for man-db ...
Setting up pdfcrack (0.11-1) ...

FreeBSD: Install pdfcrack

To install pdfcrack use the port as follows:
# cd /usr/ports/security/pdfcrack/
# make install clean
Or use the package manager as follows:
# pkg_add -r pdfcrack

How do I use pdfcrack to remove password?

Its basic syntax is:

pdfcrack -f filename.pdf
pdfcrack -f filename.pdf [options]

In this example, crack a password for a file called file.pdf:
$ pdfcrack -f file.pdf
By default it work with the userpassword or you can pass the -u option:
$ pdfcrack -f file.pdf -u
OR
$ pdfcrack -f file.pdf --user
To work with the ownerpassword, type:
$ pdfcrack -f file.pdf -o
OR
$ pdfcrack -f file.pdf --owner

How do I speed up password cracking?

You can use the following options. Try passing characters as follows:
$ pdfcrack -f file.pdf -c abcdef123
Use the characters abcdef123 as charset to recover the password. In this example, stop when reaching 10 as password length:
$ pdfcrack -f file.pdf -m 10
You can also skip trying passwords shorter than 8:
$ pdfcrack -f file.pdf -n 8

Sample session

$ pdfcrack -f file.pdf
Sample outputs:

PDF version 1.3
Security Handler: Standard
V: 2
R: 3
P: -1852
Length: 128
Encrypted Metadata: True
FileID: b3909b5523f6b1ceca6b1d3e4f9a55ee
U: b5e8aab71559346b90375ccc1e8a567500000000000000000000000000000000
O: 5e3347810f0e147ed33e61562286931ab0ecf3533b095ff2bf5be6f9befd297f
Average Speed: 30145.4 w/s. Current Word: 'tZFb'
Average Speed: 30588.3 w/s. Current Word: 'F8ee'
Average Speed: 30619.2 w/s. Current Word: 'OrOg'
Average Speed: 30969.3 w/s. Current Word: 'Uzpj'
Average Speed: 31196.5 w/s. Current Word: 'jT1l'
Average Speed: 31067.5 w/s. Current Word: '4wDo'
....
..
..
found user-password: 'z12u3456'

Another session:
$ pdfcrack -f file.pdf -c 12345678
Sample outputs:

PDF version 1.3
Security Handler: Standard
V: 2
R: 3
P: -1852
Length: 128
Encrypted Metadata: True
FileID: b3909b5523f6b1ceca6b1d3e4f9a55ee
U: b5e8aab71559346b90375ccc1e8a567500000000000000000000000000000000
O: 5e3347810f0e147ed33e61562286931ab0ecf3533b095ff2bf5be6f9befd297f
found user-password: '123456'

Conclusion

This tool recently saved my butt when I forgotten password for one of the important pdf file. This is a best command line, password recovery tool for PDF-files in the niche.

Resources and recommended readings:

• PDFCrack home page
• man page – pdfcrack