Remove PDF Password with PHP

Share this page

Follow this PHP walkthrough to remove a known open password from a PDF with the Encrypt PDF API Tool. You'll see the complete Remove PDF Password sample first, then examine the transport code and API fields that matter when this PHP pattern moves into an application.

Why Remove PDF Password with PHP?

A password-protected PDF cannot participate in many downstream operations until an authorized caller supplies the current open password. Decrypt PDF creates a separate unencrypted resource that other tools can process.

A PHP customer portal may receive protected statements together with credentials supplied through a secure channel. After decryption, the service can extract text or convert the document without asking an operator to open and resave it manually.

This operation requires the correct password and does not discover, recover, or bypass unknown credentials. The uploaded encrypted source remains separate from the generated decrypted PDF, and both follow the service retention policy.

PHP Code Example

require 'vendor/autoload.php'; // Require the autoload file to load Guzzle HTTP client.

use GuzzleHttp\Client; // Import the Guzzle HTTP client namespace.
use GuzzleHttp\Psr7\Request; // Import the PSR-7 Request class.
use GuzzleHttp\Psr7\Utils; // Import the PSR-7 Utils class for working with streams.

// By default, we use the US-based API service. This is the primary endpoint for global use.
$apiUrl = "https://api.pdfrest.com";

/* For GDPR compliance and enhanced performance for European users, you can switch to the EU-based service by uncommenting the URL below.
 * For more information visit https://pdfrest.com/pricing#how-do-eu-gdpr-api-calls-work
 */
//$apiUrl = "https://eu-api.pdfrest.com";

// Toggle deletion of sensitive files (default: false)
$DELETE_SENSITIVE_FILES = false;

$client = new Client(); // Create a new instance of the Guzzle HTTP client.

$headers = [
  'Api-Key' => 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' // Set the API key in the headers for authentication.
];

$options = [
  'multipart' => [
    [
      'name' => 'file', // Specify the field name for the file.
      'contents' => Utils::tryFopen('/path/to/file', 'r'), // Open the file specified by the '/path/to/file' for reading.
      'filename' => '/path/to/file', // Set the filename for the file to be processed, in this case, '/path/to/file'.
      'headers' => [
        'Content-Type' => '' // Set the Content-Type header for the file.
      ]
    ],
    [
      'name' => 'current_open_password', // Specify the field name for the current open password.
      'contents' => 'current_example_pw' // Set the value for the current open password (in this case, 'current_example_pw').
    ],
    [
      'name' => 'output', // Specify the field name for the output option.
      'contents' => 'pdfrest_decrypted_pdf' // Set the value for the output option (in this case, 'pdfrest_decrypted_pdf').
    ]
  ]
];

$request = new Request('POST', $apiUrl.'/decrypted-pdf', $headers); // Create a new HTTP POST request with the API endpoint and headers.

$res = $client->sendAsync($request, $options)->wait(); // Send the asynchronous request and wait for the response.

$body = (string) $res->getBody();
echo $body; // Output the response body

// All files uploaded or generated are automatically deleted based on the
// File Retention Period as shown on https://pdfrest.com/pricing.
// For immediate deletion of files, particularly when sensitive data
// is involved, an explicit delete call can be made to the API.
//
// Deletes all files in the workflow, including outputs. Save all desired files before enabling this step.

if ($DELETE_SENSITIVE_FILES) {
  $delete_client = new Client(['http_errors' => false]);
  $delete_headers = [
    'api-key' => 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
    'Content-Type' => 'application/json'
  ];
  $json = json_decode($body, true);
  $input_id = isset($json['inputId']) ? $json['inputId'] : '';
  $output_id = isset($json['outputId']) ? $json['outputId'] : '';
  $delete_body = json_encode([ 'ids' => $input_id . ', ' . $output_id ]);
  $delete_request = new Request('POST', $apiUrl.'/delete', $delete_headers, $delete_body);
  $delete_res = $delete_client->sendAsync($delete_request)->wait();
  echo $delete_res->getBody() . PHP_EOL;
}

Source for Remove PDF Password: View the PHP sample on GitHub.

Breaking Down the Code

Load Guzzle and its stream helpers

require 'vendor/autoload.php'; // Require the autoload file to load Guzzle HTTP client.

use GuzzleHttp\Client; // Import the Guzzle HTTP client namespace.
use GuzzleHttp\Psr7\Request; // Import the PSR-7 Request class.
use GuzzleHttp\Psr7\Utils; // Import the PSR-7 Utils class for working with streams.

Guzzle supplies the HTTP client and PSR-7 request objects used throughout the Remove PDF Password example. For this PHP Remove PDF Password flow, Utils::tryFopen creates readable multipart streams without loading every uploaded byte into one string.

Select the pdfRest service region

// By default, we use the US-based API service. This is the primary endpoint for global use.
$apiUrl = "https://api.pdfrest.com";

/* For GDPR compliance and enhanced performance for European users, you can switch to the EU-based service by uncommenting the URL below.
 * For more information visit https://pdfrest.com/pricing#how-do-eu-gdpr-api-calls-work
 */
//$apiUrl = "https://eu-api.pdfrest.com";

// Toggle deletion of sensitive files (default: false)
$DELETE_SENSITIVE_FILES = false;

The active $apiUrl selects the US service for Remove PDF Password; the commented assignment shows the EU alternative. Keep the PHP uploads, request IDs, and generated resources for Remove PDF Password on that same regional host.

Build the password-removal multipart body

$options = [
  'multipart' => [
    [
      'name' => 'file', // Specify the field name for the file.
      'contents' => Utils::tryFopen('/path/to/file', 'r'), // Open the file specified by the '/path/to/file' for reading.
      'filename' => '/path/to/file', // Set the filename for the file to be processed, in this case, '/path/to/file'.
      'headers' => [
        'Content-Type' => '' // Set the Content-Type header for the file.
      ]
    ],
    [
      'name' => 'current_open_password', // Specify the field name for the current open password.
      'contents' => 'current_example_pw' // Set the value for the current open password (in this case, 'current_example_pw').
    ],
    [
      'name' => 'output', // Specify the field name for the output option.
      'contents' => 'pdfrest_decrypted_pdf' // Set the value for the output option (in this case, 'pdfrest_decrypted_pdf').
    ]
  ]
];

$request = new Request('POST', $apiUrl.'/decrypted-pdf', $headers); // Create a new HTTP POST request with the API endpoint and headers.

$res = $client->sendAsync($request, $options)->wait(); // Send the asynchronous request and wait for the response.

$body = (string) $res->getBody();
echo $body; // Output the response body

// All files uploaded or generated are automatically deleted based on the
// File Retention Period as shown on https://pdfrest.com/pricing.

This block constructs the operation-specific input for Remove PDF Password. Its file parts carry binary content, while the named Remove PDF Password fields describe pdfRest behavior rather than syntax supplied by PHP.

Send the decrypt request and read its JSON

$request = new Request('POST', $apiUrl.'/decrypted-pdf', $headers); // Create a new HTTP POST request with the API endpoint and headers.

$res = $client->sendAsync($request, $options)->wait(); // Send the asynchronous request and wait for the response.

$body = (string) $res->getBody();
echo $body; // Output the response body

// All files uploaded or generated are automatically deleted based on the
// File Retention Period as shown on https://pdfrest.com/pricing.

The PHP request joins the Remove PDF Password endpoint, authentication header, and prepared body. For this Remove PDF Password call, the multipart metadata generated by PHP must remain paired with the body so pdfRest can separate files from options.

Optionally remove sensitive resources

if ($DELETE_SENSITIVE_FILES) {
  $delete_client = new Client(['http_errors' => false]);
  $delete_headers = [
    'api-key' => 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
    'Content-Type' => 'application/json'
  ];
  $json = json_decode($body, true);
  $input_id = isset($json['inputId']) ? $json['inputId'] : '';
  $output_id = isset($json['outputId']) ? $json['outputId'] : '';
  $delete_body = json_encode([ 'ids' => $input_id . ', ' . $output_id ]);
  $delete_request = new Request('POST', $apiUrl.'/delete', $delete_headers, $delete_body);
  $delete_res = $delete_client->sendAsync($delete_request)->wait();
  echo $delete_res->getBody() . PHP_EOL;
}

The optional PHP cleanup path collects the sensitive input and output IDs and sends them to Delete Files. Enable this Remove PDF Password cleanup only after the PHP application has preserved every result it needs.

Beyond the Tutorial

This walkthrough gives you an authorized PHP path from a password-protected source to a decrypted PDF resource that downstream tools can use.

Keep passwords out of logs and source control, download any required result before deletion, and enable explicit cleanup when decrypted content is sensitive. The sample includes an optional delete path for removing both input and output resources promptly.

Try the Remove PDF Password workflow with a representative file in API Lab, then adapt the request in PHP. The Encrypt PDF API Tool documentation provides the complete PHP context for Remove PDF Password values, defaults, and limitations.

Note: This PHP Remove PDF Password tutorial uses a multipart file upload. For Remove PDF Password content already stored in pdfRest, the PHP JSON payload example supplies a managed resource ID instead of uploading the file again.

How to Remove PDF Password with PHP