---
title: "Decrypt or encrypt a PDF"
url: https://recursiveai.org/onepdf/cookbook/decrypt-pdf/
description: "Remove the password from a PDF you are allowed to open, in C#, or encrypt one with AES-256, a password and permission flags, with OnePDF."
version: "1.11.0"
---

# Decrypt or encrypt a PDF

Remove the password from a PDF you are allowed to open, in C#, or encrypt one with AES-256, a password and permission flags, with OnePDF.

```csharp
using OnePdf;

// Encrypt: AES-256 with a password to open the file and an owner password.
using (PdfDocument doc = PdfDocument.Open("report.pdf", new PdfOpenOptions { AllowEditing = true }))
{
    doc.Save("locked.pdf", new PdfSaveOptions
    {
        Encryption = PdfEncryptionAction.Set,
        NewEncryption = new PdfEncryptionOptions
        {
            UserPassword = "open sesame",
            OwnerPassword = "owner secret",
            Permissions = PdfPermissions.Print | PdfPermissions.PrintHighQuality,   // printing only
        },
    });
}

// Decrypt: open with either password, then save without encryption.
try
{
    using PdfDocument doc = PdfDocument.Open("locked.pdf", new PdfOpenOptions { Password = "open sesame", AllowEditing = true });
    Console.WriteLine($"{doc.Encryption?.Cipher}, opened as {doc.AccessLevel}, permissions: {doc.Permissions}");
    doc.Save("unlocked.pdf", new PdfSaveOptions { Encryption = PdfEncryptionAction.Remove });
}
catch (PdfPasswordException)
{
    Console.WriteLine("wrong or missing password");
}

using (PdfDocument plain = PdfDocument.Open("unlocked.pdf"))
    Console.WriteLine($"unlocked.pdf: encrypted={plain.Encryption is not null}, {plain.PageCount} pages");

// Many files have only an owner password. They open without one, and the same save writes a plain copy.
using (PdfDocument doc = PdfDocument.Open("opm1644.pdf", new PdfOpenOptions { AllowEditing = true }))
{
    Console.WriteLine($"opm1644.pdf: {doc.Encryption?.Cipher}, opened as {doc.AccessLevel}");
    doc.Save("opm1644-plain.pdf", new PdfSaveOptions { Encryption = PdfEncryptionAction.Remove });
}
```

```text
Aes256, opened as User, permissions: Print, PrintHighQuality
unlocked.pdf: encrypted=False, 6 pages
opm1644.pdf: Rc4, opened as User
```

`opm1644.pdf` is OPM Form 1644, a US government form encrypted with RC4 and an owner password only. `qpdf` reports both `unlocked.pdf` and `opm1644-plain.pdf` as not encrypted.

## Decrypting

- OnePDF reads the standard security handler, revisions 2 to 6: RC4 40 and 128 bits, AES-128 and AES-256.
- `PdfOpenOptions.Password` is tried as the user password, then as the owner password. The empty password is always tried, which is why files with only an owner password open without one.
- A wrong or missing password throws `PdfPasswordException`. A file encrypted with certificates (the public-key handler) isn’t supported and throws `PdfEncryptionException`.
- `PdfEncryptionAction.Remove` in the save writes the document without encryption.

## Encrypting

- `PdfEncryptionAction.Set` with `PdfEncryptionOptions` encrypts on save: `UserPassword` to open the file (empty for none), `OwnerPassword`, `Permissions` and `Cipher` (`Aes256`, the default, or `Aes128`). RC4 is never written for a new encryption.
- `Encryption = PdfEncryptionAction.Keep`, the default, saves an encrypted document with the same passwords and permissions.
- Encrypted output isn’t byte-identical between runs, because of random initialization vectors and salts.

## Permissions

OnePDF reports the permission flags in `doc.Permissions` and doesn’t enforce them. Honoring them, for example not removing encryption from a file whose owner restricted changes, is up to your application.

The details are in [Writing](https://recursiveai.org/onepdf/docs/writing/) and [Reading and repair rules](https://recursiveai.org/onepdf/docs/repair/).