How to sign a PDF after removing its password
A contract arrives with a PDF password, you enter the password to open it, but the PDF refuses your signature because of the owner-password restriction. You’re authorised to sign — the sender gave you the password — but the PDF’s edit restriction blocks the signature tool. This guide covers the legitimate workflow: remove the restriction you have permission to remove, apply your signature, then either re-encrypt or ship the signed PDF as the sender expects.
Why this happens — owner vs user passwords
PDFs have two separate passwords: the user password (opens the document) and the owner password (permits editing, printing, signing, or copying). Many contract PDFs open without a user password but have an owner password that blocks editing. Adobe Reader, Preview, and most signature tools respect the owner-password restriction and refuse to apply a signature without it. See our PDF password types guide for the full mechanics.
If the sender gave you permission to sign (and often also gave you the owner password, or the PDF has no owner password set but was created with default restrictions), you’re within your rights to remove the restriction and apply the signature.
The legitimate workflow
- Confirm permission. Email or ask the sender: “Am I authorised to sign this PDF?” Their “yes” is your record. Keep the email.
- Remove the owner-password restriction using remove PDF password. This runs in-browser — the PDF never uploads. If the PDF has an owner password, enter it; if it has default restrictions without a set password, the tool unlocks immediately.
- Apply your signature. Most operating systems have a signature tool:
- macOS: Preview → Annotate toolbar → Signature icon → draw or photograph your signature, then click where you want it applied.
- Windows: Adobe Acrobat Reader (free) → Fill & Sign → Sign Yourself → Add Signature.
- iOS: Files app → tap PDF → Markup → signature tool.
- Android: Adobe Acrobat Reader mobile → Fill & Sign.
- Save as signed. Use “Export as PDF” or “Save a Copy” — this flattens the signature into the document.
- Optionally flatten the PDF with flatten PDF to prevent the signature from being edited or moved after signing.
- Optionally re-apply a password with protect PDF by password if the sender expects the signed version to be password-protected.
- Return the signed PDF to the sender via email or whatever channel they specified.
What the in-browser tools do — and don’t do
The remove-password tool reads the PDF into your browser’s tab, calls the PDF library’s unlock() function with your password, and writes the unlocked PDF back. Nothing uploads; nothing is logged. The tool can process owner-password-protected PDFs, default-restricted PDFs, and PDFs where you know the user password. It cannot crack an unknown password — that’s not supported and not legal in most jurisdictions.
The flatten tool merges annotations (signatures, form fields, comments) into the underlying page content. After flattening, the signature is a permanent part of the page; nobody — including you — can move or edit it without re-generating the whole PDF.
Handling edge cases
“Signed and encrypted” in one step. Some recipients expect the returned PDF to be both signed AND password-protected. Sign first (flatten), then re-apply a password. The PDF tools on this site chain cleanly: unlock → sign (offline) → protect.
Digital certificate signatures (PAdES). A cryptographic signature embedded in the PDF via a signing certificate (from a CA or self-signed) is stronger than a drawn signature. macOS Preview can apply a Keychain-stored certificate; Acrobat Reader has a “Digital ID” workflow. Our in-browser flatten tool cannot apply PAdES — that requires a local signing certificate and the native signature UI.
Signature appears but “This document has been modified” warning shows. Expected if the original PDF was digitally signed by the sender. Removing the password breaks the original digital signature (any modification does). If the sender specifically wants their original signature preserved, contact them and ask them to send an unrestricted PDF for signing.
Legal considerations
Removing a PDF password you have permission to remove is legal in every jurisdiction we’re aware of. Removing a password you don’t have permission to remove (bypassing DRM on a document you’re not authorised to edit) can violate computer-misuse laws, copyright law, or contract terms. The golden rule: if the sender gave you the password, or explicitly authorised you to sign, the removal-and-sign workflow is legitimate. If you’re unsure, ask.
Signed PDFs are legally binding in most jurisdictions, equivalent to a hand-signed paper contract. A drawn or image-based signature is generally sufficient for non-critical agreements; critical contracts (home purchase, business acquisition, legal filings) increasingly require certificate-backed digital signatures via DocuSign, Adobe Sign, or equivalent.
Privacy and the in-browser tools
Every step in this workflow runs in-browser via WebAssembly PDF libraries. Nothing uploads; nothing is stored; nothing is logged. Close the browser tab and the PDF is gone. For workflows involving confidential documents, this is stronger privacy than any cloud-based PDF service.
Related tools
- Remove PDF Password — the unlock step of this workflow.
- Flatten PDF — lock the signature into the page content.
- Protect PDF by Password — re-apply a password after signing.
- Compose PDF — merge the signed PDF with a cover page or appendix.
Why trust these tools
- Ten-plus years of web tooling. The freetoolonline editorial team has shipped browser-based utilities since 2015. The goal has never changed: get you to a working output fast, without an install.
- Truly in-browser — no upload. Every file-processing tool on this site runs in your browser through modern Web APIs (File, FileReader, Canvas, Web Audio, WebGL, Web Workers). Your photo, PDF, audio, or text never leaves your device.
- No tracking during tool use. Analytics ends at the page view. The actual input you paste, drop, or capture is never sent to any server and never written to any log.
- Open-source core components. The processing engines underneath (libheif, libde265, pdf-lib, terser, clean-css, ffmpeg.wasm, and others) are public and audit-able. We link to each one in its tool page's footer.
- Free, with or without ads. All tools are fully functional without sign-up. The Disable Ads button in the header is always available if you need a distraction-free run.