Do I need the password?

Yes. This removes a password you already know. It does not break encryption and will not open a document you cannot open.

Is the encryption really gone?

Yes. The pages are copied into a new document, so no encryption dictionary survives into the result rather than being merely bypassed.

What if the password is wrong?

You get a 422 saying so. Nothing is returned and nothing is guessed.

Unlock PDF API

Remove the password from a PDF you can open. Put the password in "option".

Get a free token Full API reference

Endpoint	POST https://astralpdf.com/api/v1/unlock-pdf
Auth	Bearer token, free
Sends	input: base64
Returns	result: base64
Price	Free. 1,000 calls a day, 60 a minute.

When to call it

An encrypted file cannot be indexed, previewed, merged or read by anything downstream. Removing the password once, in the step that receives the file, is what lets the rest of the pipeline treat it like any other document.

For a one-off, the browser version needs no token and never sends your data anywhere: it runs on your own machine.

Example

curl

curl -X POST https://astralpdf.com/api/v1/unlock-pdf \
  -H "Authorization: Bearer ast_YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"input": "JVBERi0xLjcKJYGBgYEK...", "option": "correct-horse-battery"}'

response

{
  "tool": "unlock-pdf",
  "result": "JVBERi0xLjcKJWDjz9MKMSAwIG9iago8PC9UeXBlL0NhdGFsb2c...",
  "chars": 2410,
  "ms": 61
}

In your language

JavaScript

const res = await fetch("https://astralpdf.com/api/v1/unlock-pdf", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ASTRAL_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"input": "JVBERi0xLjcKJYGBgYEK...", "option": "correct-horse-battery"}),
});
if (!res.ok) throw new Error((await res.json()).detail);
const { result } = await res.json();

Python

import os, requests

res = requests.post(
    "https://astralpdf.com/api/v1/unlock-pdf",
    headers={"Authorization": f"Bearer {os.environ['ASTRAL_TOKEN']}"},
    json={"input": "JVBERi0xLjcKJYGBgYEK...", "option": "correct-horse-battery"},
    timeout=30,
)
res.raise_for_status()
result = res.json()["result"]

Parameters

Field	Type	Notes
input	string	Required. The file, base64 encoded. A data: URL is accepted too. Up to 6,000,000 characters per call.
option	string	See the example above.

Errors

Errors are RFC 7807 problem documents with a stable type you can branch on.

missing-token	401	No Authorization header.
bad-request	400	input missing or the wrong type.
tool-failed	422	The input could not be processed. detail says why.
quota-exceeded	429	Past 1,000 calls today.

Questions

Do I need the password?: Yes. This removes a password you already know. It does not break encryption and will not open a document you cannot open.
Is the encryption really gone?: Yes. The pages are copied into a new document, so no encryption dictionary survives into the result rather than being merely bypassed.
What if the password is wrong?: You get a 422 saying so. Nothing is returned and nothing is guessed.

Other endpoints

A token takes thirty seconds

Free, no card, 1,000 calls a day, and the same token works on astraltext.com, astralpdf.com, astraljson.com and astralbatch.com.

Get a free token