pdf2john

A Rust tool that extracts password hashes from encrypted PDF files for use with John the Ripper.

This is a rewrite of the Python pdf2john script, producing identical output.

Install

cargo install pdf2john

Build

cargo build --release

Usage

pdf2john [OPTIONS] <PDF_FILES>...

Arguments

• <PDF_FILES>... - One or more PDF files to extract hashes from

Options

• -s, --show-filename - Prefix output with filename: (John the Ripper convention)
• -h, --help - Print help

Examples

Extract a hash:

$ pdf2john encrypted.pdf
$pdf$2*3*128*-1852*1*16*8c9f0eed2812e81a...

Extract with filename prefix (for use with John):

$ pdf2john -s encrypted.pdf
encrypted.pdf:$pdf$2*3*128*-1852*1*16*8c9f0eed2812e81a...

Process multiple files:

$ pdf2john file1.pdf file2.pdf file3.pdf

Pipe directly to John the Ripper:

$ pdf2john encrypted.pdf > hash.txt
$ john hash.txt

Output Format

$pdf$<V>*<R>*<Length>*<P>*<EncryptMetadata>*<id_len>*<id_hex>*<u_len>*<u_hex>*<o_len>*<o_hex>

For revision 5/6 PDFs, additional fields are appended:

...*<oe_len>*<oe_hex>*<ue_len>*<ue_hex>

Supported Encryption Revisions

Testing

cargo test

Test PDFs and expected hashes are in docs/. The expected hashes were generated by pdf2john.py and are used to verify identical output. The test suite covers:

License

See LICENSE. Redistribution and use in source and binary forms, with or without modification, are permitted.