How to Unlock an Acrobat 9 PDF (AES-128 Encryption)

Adobe Acrobat 9, released in 2008, introduced AES-128 encryption as the default for password-protected PDFs. If you have a locked PDF from this era, you are dealing with a mid-strength cipher that sits in a sweet spot: strong enough that brute force alone is impractical, but weak enough that smart dictionary attacks succeed roughly half the time.

This guide explains exactly what AES-128 means for your recovery chances, how the cracking process works, and what you can do to maximize your odds.

What Is AES-128 Encryption and Why Does It Matter?

AES stands for Advanced Encryption Standard, and the 128 refers to the key length in bits. When Adobe adopted AES-128 for Acrobat 9, it was a major leap from the RC4 ciphers used in earlier versions. RC4-40, used in Acrobat 2 through 4, could be broken by exhaustively testing every possible key. AES-128 makes that approach impossible — there are 2^128 possible keys, a number so large that testing all of them would take longer than the age of the universe.

However, password cracking does not target the key directly. It targets the human-chosen password that generates the key. And this is where attackers have an advantage: most people choose predictable passwords. Dictionary words, names, dates, and simple patterns account for the vast majority of real-world PDF passwords.

Key facts about Acrobat 9 AES-128:

• Encryption algorithm: AES (Rijndael) with a 128-bit key
• PDF encryption revision: 4 (sometimes listed as “Adobe Standard” encryption)
• Hashcat mode: 10500
• GPU cracking speed: approximately 3-5 million hashes per second on a modern RTX 4090
• Realistic success rate: 50-70% for typical human-chosen passwords

How to Identify If Your PDF Uses AES-128

Before attempting recovery, confirm that your PDF actually uses AES-128. The encryption type determines which attack strategies are effective and how long they take.

Using Adobe Acrobat Reader: Open the file properties (File > Properties > Security tab). Look for the encryption method. If it says “AES 128-bit” or references Acrobat 9 compatibility, you have AES-128.

Using PDFUnlock: Upload your PDF to pdfunlock.app and the system automatically detects the encryption type. You will see a badge showing “AES-128” along with an estimated success rate before any payment is required.

Using the command line: Tools like qpdf --show-encryption yourfile.pdf or pdfinfo yourfile.pdf display the encryption details including the algorithm and key length.

If your PDF shows RC4 encryption instead, you have an older file with significantly higher recovery chances — see our guide on unlocking old Acrobat PDFs. If it shows AES-256, you have a newer file with lower recovery chances.

The 5-Phase Recovery Process

Professional PDF password recovery does not simply try random combinations. It follows a structured approach that tests the most likely passwords first, progressing to broader searches only if needed.

Phase 1 — Top common passwords (seconds). The first pass tests the 1,000 most commonly used passwords worldwide. You would be surprised how often passwords like “password123”, “letmein”, “123456”, or “qwerty” are used even for important documents. This phase completes in under a second.

Phase 2 — Extended dictionary (seconds to minutes). The cracking engine runs through a comprehensive wordlist of 14.3 million known passwords sourced from real data breaches. If the password has ever appeared in a leaked database, this phase catches it.

Phase 3 — Dictionary with rules (minutes). This is where recovery gets intelligent. Rule-based attacks take every word in the dictionary and apply hundreds of transformations: capitalizing the first letter, appending numbers, replacing letters with symbols (a becomes @, e becomes 3), reversing words, combining two words. The password “Summer2024!” would be caught here even though it never appeared in any breach, because “summer” is in the dictionary and the capitalization-plus-year-plus-symbol pattern is a common rule.

Phase 4 — Advanced rules (hours). A more exhaustive rule set generates millions of mutations per dictionary word. This phase catches passwords that use more creative transformations while still being based on a dictionary word.

Phase 5 — Targeted brute force (hours to days). If dictionary attacks fail, the system attempts systematic brute force on shorter passwords, testing all combinations up to 8 characters. For AES-128, this is feasible for passwords up to about 6-7 characters in a reasonable timeframe.

What Affects Your Success Rate

The 50-70% success rate for AES-128 is an average. Your specific odds depend on several factors.

Password complexity. A password based on a dictionary word with minor modifications (capital letter, trailing number) has over 90% chance of being found. A truly random 12-character password has near-zero chance. Most real-world passwords fall somewhere in between.

Password length. Shorter passwords are exponentially easier to crack. A 6-character password is found almost every time. An 8-character password has good odds. A 12-character random password is effectively uncrackable with current hardware.

Password origin. If you set the password yourself, you probably used a pattern you have used elsewhere. Think about your typical password habits. If the password was generated by software (a password manager, a corporate system), recovery is much harder.

What you remember. Even partial knowledge helps enormously. If you know the password started with a capital letter and ended with a number, or that it was roughly 8 characters long, these constraints can be used to narrow the search space by orders of magnitude.

Step-by-Step: Recovering Your Acrobat 9 PDF Password

1. Upload your PDF to pdfunlock.app. The system accepts files up to 100 MB.
2. Review the analysis. Within seconds, the system identifies the encryption type (AES-128), confirms it is a user password, and shows you the estimated success rate.
3. Start the recovery. The 12-phase process begins automatically. You can close the browser and provide your email address — you will be notified when the job completes.
4. Check results. If the password is found, you see a success notification. The password is revealed only after payment.
5. Pay only if found. PDFUnlock uses a pay-on-success model. If the password is not recovered, you pay nothing. Zero risk.

Alternatives to Password Recovery

If recovery does not succeed or you prefer to try other approaches first:

Check your password manager. Search for entries created around the time the PDF was made. Try searching for “pdf”, “acrobat”, or the document filename.

Search your email. Passwords are often shared via email. Search for the filename or the word “password” around the date the file was created or received.

Contact the author. If someone else created the PDF, they may still have the password or an unprotected copy.

Try passwords manually. Before uploading, try the passwords you commonly use. Variations of your name, birthday, pet names, and common base words with numbers appended cover a surprising portion of real-world passwords.

Conclusion

Acrobat 9 PDFs with AES-128 encryption sit in a recoverable middle ground. They are significantly harder to crack than older RC4-encrypted files, but the success rate of 50-70% means the odds are in your favor for typical passwords. Start with a free analysis at PDFUnlock to see your specific encryption type and estimated chances — and remember, you only pay if the password is actually found.