How To Crack PDF Passwords In Your Sleep

There are many reasons a PDF might be locked. The author may want to prevent unauthorized editing, or in the case of a magazine, the publisher may want to prevent readers from printing the online version. I honestly rarely have a need for this kind of thing, but it does come up, so when Eltima Software asked if I wanted to review a copy of their software, Recover PDF Password, I agreed. They also offered up a couple more free licenses to my readers, so read to the end to find out how to get a free license or cash.

How it works
Like many password crackers, Recover PDF Password uses a “brute force” method to guess at a password. By this, I mean that it tries every combination over and over again until one matches. One thing I liked was that I could choose to exclude some of the more complete searching options like special characters ($%^&*, etc), numbers, or upper case letters to name a few. This speeds up the search incredibly at the risk of missing the correct password completely if it has one of these characters. To give you an idea of the speed difference, imagine you’re lucky enough to know that the password is six characters in length. To just try searching with the lower case alphabet, (if my math is right) the software has to try up to 308,915,776 possible character combinations (26 * 26 * 26 * 26 * 26 * 26). If you add in 26 upper case alpha + 10 numeric + 28 special characters, you get 90 characters total and 90 * 90 * 90 * 90 * 90 * 90 makes 5.31441e+11 (531,441,000,000) possible combinations to try. That’s about 1,720 times more than just lowercase alpha characters. Having the option to pick and choose is a big plus. Remember, too, that this is if you’re lucky enough to know the password length and it’s only six characters. The problem with cracking passwords is a matter of the time it takes, and this program does in hours what it would take you a lifetime to do on your own.

What I think is missing is the ability for the software to try dictionary words first. A good password will be a combination of upper and lower case alpha characters, special characters, and numeric digits, but let’s face it… too often, the password is merely “password” and a large portion of the rest are dictionary words. Using the method above, it might take 19 billion or so tries, give or take a billion, to conclude that the password is “password”. Trying all the 8-character words from a dictionary file would take somewhere in the tens of thousands of guesses. This is a feature I’d really like to see in any password cracking tool, as it should be used as a first pass, just in case.

My tests
First, I downloaded Recover PDF Password. The download took about a half hour, but I tried again (twice) later, and it came down in around 14 seconds both times. Then, I grabbed a random (locked) PDF from the web. I first tried with all the options on and was getting nowhere after a day. I decided to start over, telling it to try anything with lowercase characters and numbers from three to four characters in length. That went pretty quickly, eliminating all possibilities. Next, I moved on to 5-6 characters, which took a lot longer, as expected, due to the exponential growth in combinations to try. The program eliminated all 5-character combinations and then, about a third of the way through the alphabet, it recovered a 6-character password for me. The total search took 19 hours, 50 minutes, 28 seconds, and used about 50% cpu and 25MB of RAM pretty consistently.

After thinking about my wish that a dictionary file be used for the first pass, I decided to try a PDF with a password of “password” just for kicks. I grabbed one from Adobe’s site and set Recover PDF Password loose on it, trying only lowercase alpha characters and only with a length of 8. After about five minutes, it was estimating 100-108 days remaining.

Conclusions
First of all, it does what it says, so that’s good. At the $39.95 price for a personal license, it’s also within reach of anyone needing to recover a password on a PDF without breaking the bank. The down side is that a good password will take a very long time to crack, but that’s going to be true for any program, I guess. I’d love to see a dictionary file used, but it won’t make a difference for a secure password. The software is solid and complete with useful options to help save time and it’s worth the purchase as long as you can let it run in the background for a while.

UPDATE: Eltima Software tells me that they are now working on implementing the request for use of a dictionary file. That’s great news.

Get a free license
Want to try it out yourself or just have it handy for when you really need it? Eltima Software gave me two licenses to give away to readers. All you have to do to try for one is tweet with “http://Lnk.gd/ej” and “@joetech” and you’ve earned an entry. If someone re-tweets your tweet, you get another entry for every RT. Just to spice things up a little, I’ll throw in $20 (via PayPal) to a third winner. I’ll draw three twitter users at random from those who have entered. To collect, I have to be able to send you a direct message, so make sure to follow @joetech in case you win.