mozilla/pdf.js · error · FormatError

unknown encryption method

Error message

unknown encryption method

What it means

Thrown by the CipherTransformFactory constructor when the encryption dictionary's Filter entry is not the name 'Standard'. PDF.js only implements the Standard security handler defined by the PDF spec; any other handler (public-key/PKI handlers like Adobe.PPKLite, custom plug-in handlers, or a missing/malformed Filter entry) is rejected up front. The PDF cannot be decrypted and parsing of encrypted streams will not proceed.

Source

Thrown at src/core/crypto.js:1064

    key[i++] = num & 0xff;
    key[i++] = (num >> 8) & 0xff;
    key[i++] = (num >> 16) & 0xff;
    key[i++] = gen & 0xff;
    key[i++] = (gen >> 8) & 0xff;
    if (isAes) {
      key[i++] = 0x73;
      key[i++] = 0x41;
      key[i++] = 0x6c;
      key[i++] = 0x54;
    }
    const hash = calculateMD5(key, 0, i);
    return hash.subarray(0, Math.min(n + 5, 16));
  }

  constructor(dict, fileId, password) {
    const filter = dict.get("Filter");
    if (!isName(filter, "Standard")) {
      throw new FormatError("unknown encryption method");
    }
    this.filterName = filter.name;
    this.dict = dict;
    this.#fileId = fileId;
    const algorithm = dict.get("V");
    if (
      !Number.isInteger(algorithm) ||
      (algorithm !== 1 && algorithm !== 2 && algorithm !== 4 && algorithm !== 5)
    ) {
      throw new FormatError("unsupported encryption algorithm");
    }
    this.algorithm = algorithm;
    let keyLength = dict.get("Length");
    if (!keyLength) {
      // Spec asks to rely on encryption dictionary's Length entry, however
      // some PDFs don't have it. Trying to recover.
      if (algorithm <= 3) {
        // For 1 and 2 it's fixed to 40-bit, for 3 40-bit is a minimal value.

View on GitHub (pinned to 5903d58d58)

Solutions

1. Re-save the PDF with Standard security (RC4/AES) using Acrobat, qpdf --decrypt, or another tool, then reload it.
2. If you control generation, configure the producer (e.g., iText, reportlab, LibreOffice) to use the Standard security handler rather than certificate encryption.
3. Pre-scan PDFs and surface a clear 'unsupported encryption' message to end users instead of letting the raw FormatError propagate.

Example fix

// before
const task = getDocument({ url });

// after — detect non-Standard encryption up front and inform the user
try {
  const task = getDocument({ url });
  const doc = await task.promise;
} catch (e) {
  if (e.message === 'unknown encryption method') {
    throw new Error('This PDF uses a non-Standard security handler (e.g. certificate encryption) and cannot be opened.');
  }
  throw e;
}

try {
  const doc = await getDocument({ url }).promise;
} catch (e) {
  if (e.name === 'FormatError' && e.message === 'unknown encryption method') {
    notifyUser('Unsupported security handler (only Standard encryption is supported).');
    return;
  }
  throw e;
}

When it happens

Trigger: Opening a PDF whose /Encrypt dict carries Filter /Adobe.PPKLite or another non-Standard name; opening a PDF whose /Encrypt dict has no Filter entry at all; loading a password-protected PDF produced by a tool that emits a proprietary security handler. Constructed indirectly via PDFDocument/CipherTransformFactory during initial encrypted-document setup.

Common situations: Certificate-encrypted (PKI) PDFs from enterprise signing tools; PDFs encrypted by DRM or rights-management plug-ins; rarely, a truncated Encrypt dict from a corrupt download. There is no API flag to bypass this—the handler is simply unsupported.

Related errors

• unsupported encryption algorithm
• Unknown crypto method
• invalid key length
• Invalid crypt filter name.
• No password given

AI-assisted analysis of mozilla/pdf.js@5903d58d58 (2026-08-13). Data as JSON: /api/errors/33697451170c1ae5. Report an issue: GitHub.