Remove Passwords from PDFs Before Long-Term Archival

Decrypt a sealed legal file at intake

A closed matter's PDFs were each password-protected by the case owner, who is leaving the firm. Decrypt them now, while the password is known, before they go into the records system.

Input:  matter-2025-0412.pdf  (AES-256, case-owner pw)
Field:  Enter current password → <case password>
Action: qpdf --decrypt → open copy
Next:   PDF/A → store in records DMS (role-restricted)

Full ingest pipeline for one record

Decrypt, scrub stale metadata, convert to PDF/A, then store. Each stage is a separate single-file tool run.

1. Remove Password   → open copy (password gone)
2. Metadata Scrubber → stale Author/Producer cleared
3. PDF/A converter   → PDF/A-2b
4. Move to DMS       → access by role, audit-logged

Mixed-vintage archive: RC4 and AES together

An old shared drive has files encrypted across a decade. qpdf reads both legacy RC4 and modern AES, so each can be normalised to an open copy with its own password.

2012 file (RC4-128)  + password → decrypted
2024 file (AES-256)  + password → decrypted
Result: both normalised to unencrypted archival copies

Use the owner password collected at handover

During a team handover you captured owner passwords. qpdf accepts the owner password, so you can decrypt even without each file's open password.

Handover list has OWNER passwords only.
Field:  Enter current password → <owner password>
Action: qpdf --decrypt → success
Lesson: owner password is sufficient

Password missing for one old file

One file's password was never recorded and its setter has left. There's no recovery — flag it and escalate before the rest of the archive is sealed.

Field:  Enter current password → <unknown>
Action: qpdf --decrypt → exit 2
Outcome: "could not process" — no recovery
Action:  escalate; do NOT seal the archive assuming
         this file will open later

This is precisely the long-term failure the decrypt-at-ingest pattern prevents. The tool cannot crack or recover an unknown password; a strongly encrypted file with a lost password is unrecoverable. Capture passwords during handovers, before they're gone.

qpdf exits with code 2 and reports it could not process the file. Passwords are case- and whitespace-sensitive. Re-type from the handover record carefully before flagging the file as unrecoverable.

qpdf decrypts with either the user or owner password. If your handover captured only owner passwords, they're sufficient — you don't need to chase the open passwords too.

Removing the password does not make a file archival-grade. For retention requirements, follow with the PDF/A converter; decryption and PDF/A conversion are two distinct steps.

An unencrypted file relies entirely on the archive's access controls. Store it in a DMS or encrypted volume with authentication, roles, and audit logging — not a shared open folder. The decryption removed the only barrier the file itself carried.

Old archives often use RC4 40/128-bit. qpdf reads these with the password, so even decade-old files can be normalised to unencrypted archival copies.

Long scanned records frequently exceed the free 2 MB / 50-page limit. Pro (50 MB / 500 pages) or Pro+Media (500 MB / 2,000 pages) handles larger archival documents.

The browser tool decrypts one file per run. For a bulk ingest, script the @jadapps/runner to process the folder sequentially (see the automation FAQ) — each file still needs its own correct password.

Records protected by enterprise rights management aren't password-decryptable here. They require the issuing rights server; if it's decommissioned, the records may be permanently inaccessible. Plan migrations off DRM well before the server is retired.