Category: security

Forgotten the password to an old PDF? You can try recovering it locally on Linux with pdfcrack.

This guide covers recovery of the password needed to open a PDF. Use it on your own files or files you have permission to recover.

 

IMPORTANT: pdfcrack runs on the CPU and has no built-in CUDA or NVIDIA GPU support. For NVIDIA acceleration, use Hashcat instead.

Start with a small password dictionary

A dictionary is a text file containing one password candidate per line. Start with a short list of passwords you remember using, then try common-password lists. This keeps the first attempt quick and helps check that the setup works before running a larger job.

• SecLists 10k common passwords: a useful first public list. Download the plain text file.
• SecLists password collection: browse other lists when the initial attempt fails. Choose password lists rather than web directory or URL lists.
• CrackStation dictionaries: the download page offers a human-password list of about 64 million entries and a full dictionary requiring about 15 GiB when extracted. Try these later, after smaller lists.

Download the small SecLists file on Ubuntu:

wget -O common-passwords.txt 'https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/Common-Credentials/10k-most-common.txt'

You can also make a shorter first pass:

head -n 1000 common-passwords.txt > small.txt

This takes the first 1,000 lines. It does not guarantee that they are the best candidates. Extract compressed dictionaries before using them. A larger dictionary takes longer and still cannot recover a password that is absent from the list.

Recover a PDF password with pdfcrack

Install pdfcrack on Ubuntu:

sudo apt update
sudo apt install pdfcrack wget

Replace locked.pdf with your PDF filename:

pdfcrack -f locked.pdf -w small.txt

The -f option selects the PDF and -w selects the dictionary. User-password recovery is the default. If the first list fails, repeat with common-passwords.txt. See the pdfcrack manual for other options.

The project documents support for standard security-handler revisions 2, 3 and 4. Unsupported encryption requires another tool. Installing NVIDIA drivers will not add GPU support to pdfcrack.

Use Hashcat for NVIDIA acceleration

Install Hashcat and the supporting tools:

sudo apt install hashcat git python3
nvidia-smi
hashcat -I

You need a working NVIDIA driver and a compatible CUDA installation. The Hashcat requirements page lists the NVIDIA CUDA Toolkit requirement. Confirm that hashcat -I detects your NVIDIA GPU before continuing. A working nvidia-smi alone does not confirm that Hashcat can use it.

Hashcat needs an extracted password-verification record, rather than the PDF itself. The third-party pdf2hashcat script can prepare it locally:

git clone https://github.com/sighook/pdf2hashcat.git
python3 pdf2hashcat/pdf2hashcat.py locked.pdf > locked.hash
hashcat --identify locked.hash

Select the matching PDF mode using the identification output and Hashcat’s example hashes. The encryption settings determine the mode. The PDF filename or version alone is insufficient.

For example, only if mode 10500 matches your extracted record:

hashcat -m 10500 -a 0 locked.hash common-passwords.txt
hashcat -m 10500 locked.hash --show

Here, -a 0 selects a dictionary attack, while --show displays recovered results. Check the startup output to confirm that the NVIDIA device is being used. Mode 10500 is not suitable for every PDF.

Exhausted means the selected candidates were tried without a match. It does not mean the PDF has no password. GPU acceleration can increase guessing speed, but recovery time depends on the encryption and password. A long random password may remain impractical to recover.