Decrypt PDF documents in C# and VB.NET

A PDF document can be protected with passwords, certificates, or not protected.

There are different approaches to opening PDF documents. The recommended method is to check first if a PDF file is secured. The alternative is to try opening any PDF document without checking first if it is encrypted or not. Docotic.Pdf library throws CannotDecryptPdfException exceptions for documents that require a password or certificate.

Decrypt PDF, remove password from PDF in C# and VB.NET

Check if a PDF document is protected

The library provides GetEncryptionInfo methods for checking if a PDF document is encrypted. These methods also provide information about the encryption handler used to encrypt the document.

Docotic.Pdf library 9.5.17664-dev Regression tests 14,820 passed Total NuGet downloads 4,998,853

The following C# code snippet shows how to check if a PDF file is encrypted:

var info = PdfDocument.GetEncryptionInfo(fileName);
if (info == null)
    Console.WriteLine("Is not encrypted");
else if (info is PdfStandardEncryptionInfo standardInfo)
    Console.WriteLine("Is encrypted with a password");
else if (info is PdfPublicKeyEncryptionInfo publicKeyInfo)
    Console.WriteLine("Is encrypted with a digital certificate(s)");

Many PDF documents encrypted with passwords do not require a password to open them. For such PDF files, a password is only required for the "owner" (unrestricted) mode.

if (standardInfo.RequiresPasswordToOpen)
    Console.WriteLine("Can not be opened without a password");
else
    Console.WriteLine("Does not require a password");

For a PDF document encrypted with certificates, it is possible to get information about its recipients. In other words, you can check what certificates can unlock the PDF document. Please note that document permissions depend on the actual certificate used to decrypt the PDF file.

// the Recipients property contains information about certificates
// that can be used to decrypt PDF document
foreach (var recipient in publicKeyInfo.Recipients)
    Console.WriteLine(recipient.SerialNumber);

Open encrypted PDF documents in .NET

A PDF document encrypted using passwords may or may not require a password to open it. In either case, use a PdfDocument constructor to open the document.

If the PDF file does not require a password, use a constructor without a decryption handler parameter. Docotic.Pdf library will open the document with "user" (restricted) permissions.

If the PDF document requires a password to open it, use a constructor with a handler of PdfStandardDecryptionHandler type. Use the same constructor if you want to open a secured PDF file with "owner" (unrestricted) permissions.

The following code snippet shows how to open a password-protected PDF file in C#:

using (var document = new PdfDocument(fileName, new PdfStandardDecryptionHandler("password")))
{
    // do something with the decrypted document
}

PDF documents encrypted using certificates require a matching certificate to open them. There may be more than one matching certificate for a PDF file. The author of the encrypted PDF document may grant different permissions for different matching certificates.

If you have a matching certificate installed in the current user's X.509 certificate store, use a PdfDocument constructor without a decryption handler parameter. Docotic.Pdf library will use the first matching certificate from the certificate store and use the certificate to open the document.

In cases when you don't have a matching / desired certificate installed in the current user's X.509 certificate store, create a PdfPublicKeyDecryptionHandler instance and use it with a PdfDocument constructor. You can create a handler using a certificate, key store, or a certificate store.

The following C# code snippet creates a public-key decryption handler with a certificate from a key store. Then the handler is used to open a certificate-protected PDF file:

var handler = new PdfPublicKeyDecryptionHandler("key-store.p12", "password");
using (var document = new PdfDocument(fileName, handler))
{
    // do something with the decrypted document
}

Remove protection from PDF files

To remove protection from a PDF document, follow these steps:

  • open the PDF using a PdfDocument constructor with a proper decryption handler
  • do not set up any encryption handler in the save options
  • save the PDF document

Without an encryption handler, the library will save the PDF document not encrypted.

To remove passwords from a PDF, open the document with a handler of PdfStandardDecryptionHandler type. For certificate protected documents, please use a handler of PdfPublicKeyDecryptionHandler type.

Check PDF permissions in .NET

To check permissions granted for a PDF document, you would need to create or open the document first. It does not matter if you open an encrypted PDF file or a file without protection.

This code snippet shows how to check PDF permissions in C#:

// create a new or open an existing document
using (PdfDocument document = ...)
{
    Console.WriteLine("Document permissions = {0}", document.GrantedPermissions);
}