Convert Protected PDF to Word: What the Lock Allows

To convert a protected PDF to Word, work out which lock the file carries. If you hold the password and have authority to use it, open the PDF, save a copy with security turned off, and convert that copy. If you do not, ask the sender for an unprotected version.

"Protected" covers several different things, and a converter fails in a different way for each. Some files will not open at all. Others open, print and read normally but refuse to give up their text. Knowing which you have saves an afternoon of trying tools that were never going to work.

What kinds of protection can a PDF carry?

A PDF can carry three kinds of protection: a password needed to open it, a second password that limits what an opened file lets you do, and encryption addressed to named recipients by certificate. All three encrypt the file. They differ in who can get in and what is allowed once the file is open.

The password that opens the file

The PDF specification calls this the user password. Without it the file is unreadable, and no program can show you a page. Many PDF programs label it the "document open password" or simply "password to open". It is the lock you meet on, for example, a bank statement sent by email or a personnel file sent by an HR department.

The password that sets permissions

The specification calls the second one the owner password. The published PDF specification, ISO 32000-1, says in section 7.6.3 that its standard security handler allows access permissions and up to two passwords for a document, "an owner password and a user password". Opening with the owner password gives full access, including the ability to change the passwords and permissions. Opening with the user password gives only what the permission settings allow.

The same section lists the operations a permission setting can control. They include printing, modifying the contents, copying or extracting text and graphics, adding annotations and filling in form fields, and assembling the document by inserting, rotating or deleting pages.

A file can have an owner password and no user password. It then opens for anyone, with no prompt, and still refuses to let you copy a sentence. This is the case that confuses people most, because nothing on screen says the file is locked until an action fails.

Programs expose these settings in their own words. Apple's instructions for password-protecting a PDF in Preview on a Mac, for example, describe an option to require a password to open the document, a set of checkboxes for actions allowed "without the owner password", and a separate owner password field.

Certificate encryption

The third kind uses no shared password. The specification's public-key security handler encrypts the file for a list of recipients using each person's certificate, and a recipient needs the matching private key to decrypt it. In practice the file opens on the computer where your digital ID is installed and nowhere else. An upload to any online service is, to that service, an unreadable file.

Things that look like protection and are not

• A scan. An image-only PDF also refuses to let you select text, but nothing is locked. It has no text to select.
• A digital signature. A signed PDF may warn you that changes will invalidate the signature. That is a property of the signature, not a password.
• A flattened form. Fields that can no longer be edited have been merged into the page. There is nothing to unlock.
• A read-only file attribute. That is a setting of the folder or the operating system, not of the PDF.

How do you tell which restriction is blocking a PDF conversion?

Open the PDF's document properties and read the security panel. It names the security method and lists, action by action, what is allowed. Combine that with what happened when you opened the file and you can place the problem in one of a handful of cases.

In most PDF programs the properties are under the File menu, with a tab or section called Security. Look for three things: the security method (none, password, or certificate), whether a password was needed to open, and the list of allowed actions. The lines that matter for conversion are content copying, content extraction and changing the document.

Two of those rows are not protection problems, and they send you elsewhere. For a file that selects and pastes rubbish, see the post on how to convert a PDF to readable text. For the quick tests that separate a scan from a restricted file, the post on why you cannot copy text from a PDF has a section on permissions and odd fonts as reasons copying fails.

A file can have more than one problem. A scanned lease saved with a permissions password is both an image and a locked file. Fixing the lock leaves you with a scan that still needs OCR. Read the properties first, then try to select a word, and you will know both facts.

Be wary of one false signal. An action that happens to work in the program you have open does not show that the author allowed it. The properties panel tells you what the author set. Treat that as the answer to "what did the sender intend".

Converting a password-protected PDF when you hold the password

If you hold the password and are entitled to use it, the conversion has one extra step: make an unsecured working copy in your PDF program first. Open the file with the password, save a copy with security set to none, and convert that copy to Word. Keep the protected original untouched.

Which password you need depends on what you are removing. An open password lets you read the file. Changing or removing the security settings is an owner-level action, so a program will ask for the owner (permissions) password if one was set. If you were given only the password to open, you were probably not meant to change the settings, and the sections on whether you are allowed to remove protection and on asking the sender apply.

1. Record what you received. Save the protected file in the matter folder under its original name. Note who sent it, when, and how the password reached you.
2. Open it in a desktop PDF program and enter the password.
3. Read the security panel in the document properties, so you know what you are about to change.
4. Save a working copy without security. In the security settings choose the option for no security, supply the owner password if asked, and save under a new name such as Marlowe employment agreement (working copy, security removed).pdf. Use Save As, so the original keeps its protection.
5. Test the copy. Reopen it. It should open with no prompt, and the properties should show no security.
6. Find out whether it has text. Select a sentence and paste it somewhere. Clean text means the PDF is text-based. Nothing to select means it is a scan.
7. Convert. A text-based PDF can often be saved to Word directly from your PDF program or opened in Word. A scan needs OCR: upload the working copy to an OCR tool and export DOCX.
8. Store the working copy as carefully as the original. Then delete any copies you no longer need, including the one you uploaded.

Step 8 is the one people skip. The sender protected the file for a reason, and you have just made a version with no protection at all. That copy, and the Word file made from it, deserve the same handling as the original: the same restricted folder, the same care in email. If you use an online service for the OCR step, check what it does with uploads. Schema Law's security commitments state that documents are encrypted in transit and at rest and stay inside your own account, and that you can delete any document at any time. The post on how to OCR a password-protected PDF counts the unprotected copies a conversion leaves behind and says what to do with each.

For the conversion and the review that follows, the guide on how to convert a scanned PDF to Word has the full procedure, including what to check in the DOCX before you rely on it.

If the password does not work

Passwords are case-sensitive, and the usual failures are dull ones. Check for a trailing space picked up when you copied it from an email, a zero mistaken for a capital O, or a keyboard set to another layout. Where an institution builds the password from a formula, such as part of an account number and a date of birth, reread the message that explains the formula. If none of that helps, go back to the sender. Do not reach for a recovery tool.

Are you allowed to remove protection from a PDF someone sent you?

Whether you may remove protection depends on who applied it, why, and what governs the document. Holding a password is not the same as having permission to strip it. This post cannot answer the question for your file. It can list what to look at before you decide, and when to stop and ask.

Start with what the lock says about the sender's intent:

• An open password with the password sent separately is transport security. The sender wanted to keep strangers out and wanted you in. Making a working copy for your own use is normally consistent with that, subject to anything else on this list.
• A permissions password you were not given is a statement that the author did not want the content copied, changed or extracted by recipients. Getting around it, by any means, goes against what the sender set up.
• Certificate encryption names the people meant to read the file. A decrypted copy can be read by anyone who gets hold of it.

Then look at what else governs the document:

• A protective order or confidentiality stipulation. Some orders say how designated material must be stored, copied and transmitted. Read the order before making an unprotected copy of anything produced under it.
• A contract or licence. Standards, treatises, expert reports and commercial data are often delivered under terms that restrict copying or conversion.
• Your client's own instructions, and any outside-counsel guidelines that require files to stay encrypted.
• Statute. In the United States, 17 U.S.C. § 1201 provides that no person shall circumvent a technological measure that effectively controls access to a copyrighted work, and defines circumvention to include decrypting or bypassing a measure without the copyright owner's authority. Whether that provision, or any exemption to it, reaches a particular file is a legal question to research for your facts. Other countries have their own rules.
• A file sent in error. If a locked file reached you by mistake, or you suspect you were not the intended recipient, the question of converting it comes second. Check what your own jurisdiction's professional conduct rules require before you do anything with it.

A practical test: would you be comfortable telling the sender exactly what you did? Opening a statement with the password the bank gave you and saving a copy for the file passes easily. Running a locked expert report through a tool that ignores its settings does not. In between, a short email asking for an unrestricted copy costs a day and removes the doubt.

Asking the sender for an unprotected copy of the PDF

Asking is usually the quickest clean route. Say which file you mean, what the restriction stops you doing, what you need the content for, and which form of the document would solve it. A specific request gets a file back. A vague one gets a reply asking what you mean.

What to ask for, in order of usefulness:

1. The source document, if you need to edit. A Word file from the author is better than any conversion of a PDF.
2. A PDF saved without restrictions, if you need to search, copy or quote.
3. The same PDF with only copying and extraction allowed, if the sender has a reason to keep other restrictions.
4. The permissions password, if the sender prefers to leave the file as it is and let you make your own copy.

A request might read:

Thank you for sending the Marlowe employment agreement on 2 October. The PDF opens with the password you supplied, but its settings do not allow text to be copied or the file to be exported. We need to prepare a redline of sections 4 through 9. Could you send either the Word version or a PDF saved without copy restrictions? We will handle it under the same confidentiality terms as the original.

Three things make that work. It names the file and the date. It says what is blocked in terms the sender's assistant can check in the properties panel. And it offers the sender a choice, which lets them pick the option their own policy allows.

If the file came from opposing counsel in litigation, look at the governing ESI protocol or request before you write. The form of production may already be agreed, and a restricted PDF may not match it, which is a different conversation from asking a favour. If the file came from an institution such as a bank or an insurer, the restriction may be applied automatically, and the person who can help is whoever produced the statement, not the general inbox.

Keep the reply and the new file together in the matter folder. If anyone later asks how an unrestricted copy came to exist, the email answers it.

The file you asked for is an employment agreement. Once you can copy it, check any noncompete agreement language, any nondisclosure agreement clause and the compensation description against the pages you will redline. At-will employment wording and an overtime sentence are short, so read them on the scan before you edit.

What a printed and rescanned protected PDF loses

Printing a protected PDF and scanning the paper turns a text document into a picture of one. You lose the exact characters, the searchable text, the links and bookmarks, and some sharpness. If printing was restricted too, or the lock was there to prevent copying, the workaround also defeats the sender's settings, so the authority question still applies.

Where printing is allowed and you are entitled to a working copy, print-and-scan does produce a file with no security on it. Count what it costs before you choose it.

The loss that matters most for Word conversion is the first. A text-based PDF converts to Word from its stored characters, so "Section 14.2(b)" and "$1,250,000.00" arrive exactly. A rescanned page converts by recognition, and every figure has to be read against the page again. You have traded a reliable source for one that needs proofreading.

The print permission can also carry its own limit. The specification describes a setting under which printing is restricted to a low-level representation "possibly of degraded quality". A printout made under that setting is a poor start for OCR.

So treat print-and-scan as a last resort for a file you are plainly entitled to work with and whose settings allow printing, when the sender cannot be reached and the deadline is real. If you do it, label the result as a rescan of the protected original, and keep both. The moment the sender answers with a clean copy, convert that one and retire the rescan.