How Long Does It Take to Crack a PDF Password? (Real Numbers)
Updated July 2026 • 5 min read
“How long would it take to crack my PDF's password” doesn't have one answer: it depends heavily on which encryption the file uses and, far more, on how the password itself was chosen. Below are real measured numbers, from testing done against real PDF encryption on actual GPU hardware, covering all four revisions still found in the wild, so you can see exactly where the risk actually sits.
The number that surprises people
Modern AES-256 PDFs (the strongest encryption the format offers) get tested at around 560,000 password guesses per second on a single consumer GPU, roughly eight times faster than the equivalent step on an Office 2013 document, because the PDF standard runs its key derivation only 64 times where Office runs it 100,000. The cipher is strong; the speed of testing candidates against it is not.
What “cracking” actually measures
Cracking a PDF password doesn't mean breaking the encryption mathematically, AES-256 itself is not the weak point anywhere in this. It means systematically testing candidate passwords, running each one through the PDF's key-derivation function to see whether it produces the correct key. The relevant speed, then, isn't “how strong is AES-256” (extremely), it's “how many candidate passwords per second can be tested against this specific file format's key-derivation step”, and that number varies enormously by PDF revision.
These figures come from hashcat runs against real PDF fixtures across all four encryption revisions still in use: RC4-40, RC4-128, AES-128, and AES-256 revision 6, measured on a single consumer-grade GPU. The relative differences between revisions hold on any modern GPU, since PDF key derivation is latency-bound rather than raw-throughput-bound.
The measured numbers, by encryption revision
RC4-40 (the oldest, weakest PDF encryption, from early Acrobat versions): roughly 5.5 billion candidates per second. At that speed, every possible 8-character password using lowercase letters and digits (about 2.8 trillion combinations) is exhausted in around 8.5 minutes, brute force, no dictionary needed. RC4-40's actual 40-bit encryption key can also be brute-forced directly, independent of the password entirely, in a bounded amount of time; effectively, no RC4-40 PDF is safe from someone willing to spend the compute.
RC4-128 and AES-128 (a common middle tier): roughly 167 million candidates per second. The same 8-character lowercase-plus-digit space takes about 4.7 hours to exhaust completely, still entirely feasible, and any password shorter or more common than that falls far faster via dictionary and rule-based attacks, often in seconds.
AES-256 revision 6 (the modern standard since Acrobat 9, and the strongest the format offers): roughly 560,000 candidates per second, dramatically slower than the other three, but still around eight times faster than testing candidates against an equivalent Office 2013 file, because the PDF specification's key-derivation function runs only 64 iterations, versus 100,000 for Office. A 7-character exhaustive search would take on the order of 39 hours at this rate; a weak or dictionary-based password of any length typically falls in seconds, since dictionary and rule-based attacks don't need to search the full space at all.
What this means for a weak or human-chosen password
For a password that's a dictionary word, a name, a short phrase, or a common pattern with a few numbers appended, the encryption revision barely matters: dictionary and rule-based attacks find it in seconds to minutes on any of the four revisions, because the search doesn't need to enumerate the full possible-password space, it tests the much smaller set of passwords real people actually pick. This is the single most important takeaway from the numbers above: the cipher strength (AES-256 versus RC4-40) matters far less to your real-world risk than whether the password itself was ever meant to resist a computer, rather than just a guessing human.
What this means for a strong, random password
The picture reverses completely for a genuinely random password. Testing measured that a random 12-character password, mixing case, digits and symbols, resisted every attack stage across all four encryption revisions, including RC4-40's fast brute-force path and AES-256's slower one; the full test ladder (dictionary, rule-based mutation, and bounded mask attacks) ran to completion and came up empty on every single fixture. That's not a near miss, it's the expected outcome: a random 12-character password sits so far beyond even RC4-40's 5.5-billion-per-second speed that exhausting the search space isn't realistic on any hardware budget. Length and true randomness, not the encryption revision, is what actually determines whether a password resists testing.
Why this matters if you're choosing a password to protect a PDF
If you're the one adding password protection to a PDF, these numbers point to one clear conclusion: pick a genuinely long, random password (a password manager's generated password, twelve or more characters, is ideal), and the encryption revision your PDF tool happens to use becomes close to irrelevant to your real security. Conversely, a memorable, human-chosen password gives up most of its protection regardless of which AES or RC4 revision wraps it, since dictionary-based testing doesn't care how strong the cipher underneath is.
If you're on the other side of this, trying to get back into your own PDF with a password you've genuinely forgotten, the same numbers tell you what to expect honestly: our guide to recovering a forgotten PDF password walks through what's realistically recoverable given exactly this data, and what isn't.
How these numbers were actually measured
These aren't theoretical estimates: they come from running hashcat against real PDF files built specifically to test each encryption revision, both with deliberately weak passwords (pulled from a common leaked-password list, to validate the pipeline actually works end to end) and deliberately strong ones (random 12-character passwords, to test where the wall actually sits). The weak fixtures cracked in every case, seconds to tens of seconds per file, confirming the extraction-and-testing pipeline behaves correctly against real PDF encryption rather than a simplified stand-in for it. The strong fixtures held in every case, across the full attack ladder (dictionary, then rule-based mutation, then bounded mask search), which is exactly the result you'd want to see if the wall is real rather than a gap in the testing.
Cost is the other useful way to look at these numbers. Because a testing attempt runs for a fixed budget regardless of which mode it targets, a full attempt costs roughly the same in compute time no matter the PDF's encryption revision, the revision only changes how many candidate passwords that budget can get through. A successful crack, when the password is weak enough to be found at all, tends to land within the first seconds of dictionary-based testing, which is a small fraction of that budget. In other words: the economics of testing a PDF password are dominated by whether the password is weak, not by which encryption revision protects it.
How to estimate your own PDF's realistic crack risk
A quick way to reason about how exposed your PDF's password actually is, based on measured cracking speeds.
- Identify roughly how the password was chosen — Was it a dictionary word, name, or short phrase, or a long string generated by a password manager? This matters more than the encryption revision.
- Check the PDF's encryption revision if you can — Older PDFs (pre-2008, roughly) commonly use RC4-40 or RC4-128; PDFs from Acrobat 9 onward typically use AES-128 or AES-256.
- Weigh password style against the numbers above — A human-chosen password is exposed on any revision, in seconds to hours. A long random password resists on every revision tested, including the fastest one.
- If it's a human-chosen password you've forgotten — A dedicated recovery attempt has a real chance of finding it; see our forgotten-password guide for the honest odds and the privacy-safe process.
- If it's a genuinely random password you've forgotten — No realistic recovery attempt will find it. Check password managers or original storage locations instead of expecting a crack to succeed.
Frequently asked questions
Is AES-256 PDF encryption crackable?
The cipher itself, no, not in any practical sense. What's measurable is how fast candidate passwords can be tested against it: around 560,000 per second on a single consumer GPU, which is fast enough that a weak or human-chosen password often falls quickly, even though the encryption itself is uncompromised.
Is AES-256 PDF encryption actually weaker than Office 2013 encryption?
In terms of how fast candidate passwords can be tested, yes, measurably: PDF's AES-256 (revision 6) runs its key-derivation function only 64 times, versus 100,000 for Office 2013, making candidate testing around eight times faster on PDF. The cipher itself is not weaker; the number of rounds protecting it from guessing attempts is.
How long would it take to crack a random 12-character PDF password?
Based on measured testing, a genuinely random 12-character password resisted every attack stage across all four PDF encryption revisions, including the fastest one (RC4-40 at roughly 5.5 billion guesses per second). It is not realistically recoverable on any hardware budget.
Which PDF encryption is the least safe from cracking attempts?
RC4-40, the oldest revision, tests at roughly 5.5 billion candidates per second, and its 40-bit key can also be brute-forced directly regardless of password strength. Any PDF still using RC4-40 should be treated as effectively unprotected against a determined attempt.
Does a longer password always resist cracking, regardless of PDF encryption revision?
Yes, length combined with true randomness is what matters most. Measured testing found a random 12-character password resisted every revision, including the fastest (RC4-40), while short, dictionary-style passwords fell quickly even on the slowest revision (AES-256).