When I use a tool like pdf2john.py from John The Ripper on an encrypted PDF, it gives me an output like:


I would like to know what is the hash format used? I ask because most of the online rainbow table website doesn't accept PDF format, only MD5, SHA1 etc. I wonder if it is possible to extract the non-PDF specific part out to be used in those online rainbow table website?

  • Have you tried running john on the output? John will tell you what hash type it is trying.
    – amccormack
    May 21, 2015 at 0:29
  • Read the source code for the tool, pay attention to the imported modules.
    – KDEx
    May 21, 2015 at 6:02

1 Answer 1


Hashcat lists a similar looking hash in their example hashes

10500 PDF 1.4 - 1.6 (Acrobat 5 - 8)


On John The Ripper it's also supported as you can see on this walkthrough and on JTRs example hashes. The algorithm is there just called pdf.

I neither found information on extracting an MD5/SHA1 hash etc from the PDF hash nor rainbow tables for PDF. So it's probably not possible since the PDF hash algorithm may use salting and/or iterating. So using Hashcat or John The Ripper is your only option.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .