note.nkmk.me

Encrypt and Decrypt PDFs with pypdf in Python

Posted: | Tags: Python, PDF

The Python library pypdf (formerly PyPDF2) allows you to set and remove passwords on PDF files, thereby encrypting or decrypting them as needed.

It can be used to add a password to an existing PDF or save a decrypted version of a password-protected PDF. Note that you must already know the password to decrypt a file; pypdf doesn't support password cracking or bypassing.

Contents

The sample PDFs used in this article are available at the following link. All password-protected files use password as the password:

Install pypdf

pypdf has no external dependencies and can be installed via pip (or pip3). If you need support for AES encryption and decryption, install it with the [crypto] extra.

$ pip install pypdf
$ pip install pypdf[crypto]

The examples in this article use pypdf version 5.5.0.

The library was previously known as PyPDF2 until it was renamed to pypdf in 2023.

Supported Encryption Algorithms in pypdf

When setting a password in Adobe Acrobat, you can choose from several encryption levels:

Acrobat 6.0 And Later (PDF 1.5) encrypts the document using 128-bit RC4.
Acrobat 7.0 And Later (PDF 1.6) encrypts the document using the AES encryption algorithm with a 128-bit key size.
Acrobat X And Later (PDF 1.7) encrypts the document using 256-bit AES. To apply 256-bit AES encryption to documents created in Acrobat 8 and 9, select Acrobat X And Later. Securing PDFs with passwords, Adobe Acrobat

As of version 5.5.0, pypdf supports both RC4 and AES encryption/decryption.

PDF encryption makes use of RC4 and AES algorithms with different key length. pypdf supports all of them until PDF-2.0, which is the latest PDF standard. Encryption and Decryption of PDFs — pypdf 5.5.0 documentation

Check If a PDF Is Encrypted

You can check whether a PDF file is encrypted using the is_encrypted attribute of a PdfReader object:

import pypdf

print(pypdf.__version__)
# 5.5.0

pdf = pypdf.PdfReader('data/src/pdf/sample1.pdf')
print(pdf.is_encrypted)
# False
source: pypdf_password.py

Encrypt a PDF (Set a Password)

Follow these steps to set a password on a PDF:

  1. Load the original file using PdfReader.
  2. Create a PdfWriter object with the contents cloned from the reader.
  3. Set a password using encrypt().
  4. Save the result using write().

The clone_from argument in PdfWriter() allows you to copy content directly from an existing PdfReader.

src_pdf = pypdf.PdfReader('data/src/pdf/sample1.pdf')
dst_pdf = pypdf.PdfWriter(clone_from=src_pdf)
source: pypdf_password.py

Use the encrypt() method to apply encryption:

The first argument (user_pwd) sets the user password, and the second (owner_pwd) sets the owner password. If you omit the second, it defaults to the same value as user_pwd.

You can also specify the encryption algorithm with the algorithm argument. As of version 5.5.0, the recommended algorithm is AES-256-R5.

The algorithm can be one of RC4-40, RC4-128, AES-128, AES-256-R5, AES-256. We recommend using AES-256-R5. Encryption and Decryption of PDFs — pypdf 5.5.0 documentation

Save the encrypted PDF using the write() method:

dst_pdf.encrypt('pass_user', 'pass_owner', algorithm='AES-256-R5')
dst_pdf.write('data/temp/sample1_pass.pdf')
source: pypdf_password.py

Decrypt a PDF (Remove or Change a Password)

To remove or change a password, follow the same steps as encryption, except you must first decrypt the PDF.

If you try to use clone_from on an encrypted file without decrypting, you'll get an error:

pdf_pass = pypdf.PdfReader('data/temp/sample1_pass.pdf')
print(pdf_pass.is_encrypted)
# True

# dst_pdf = pypdf.PdfWriter(clone_from=pdf_pass)
# FileNotDecryptedError: File has not been decrypted
source: pypdf_password.py

To decrypt the PDF, use the decrypt() method.

It returns:

  • 0 for incorrect password
  • 1 if it matches the user password
  • 2 if it matches the owner password
print(pdf_pass.decrypt('wrong-password'))
# 0

print(pdf_pass.decrypt('pass_user'))
# 1

print(pdf_pass.decrypt('pass_owner'))
# 2
source: pypdf_password.py

Once decrypted, you can pass the PdfReader to PdfWriter using clone_from and save it without a password:

dst_pdf = pypdf.PdfWriter(clone_from=pdf_pass)
dst_pdf.write('data/temp/sample1_no_pass.pdf')
source: pypdf_password.py

To change the password, apply encrypt() again before saving:

dst_pdf = pypdf.PdfWriter(clone_from=pdf_pass)
dst_pdf.encrypt('new_pass_user', 'new_pass_owner', algorithm='AES-256-R5')
dst_pdf.write('data/temp/sample1_new_pass.pdf')
source: pypdf_password.py

Related Categories

Related Articles