Decrypting PDFs before converting to PDF/A for long-term compliance
Converting legacy PDFs to PDF/A is no longer optional for many Australian organisations operating under federal or state recordkeeping obligations. The PDF/A format, defined under ISO 19005, was created so that documents render identically decades after they were first produced. Yet the conversion path is frequently blocked by owner-password restrictions embedded in the original files. Restrictions of this kind prevent printing, copying, editing, annotation, and form-field access, and many of the tools used to validate or convert to PDF/A refuse to work on files that carry them.
Australia's archival framework treats this issue with real seriousness. The National Archives of Australia requires federal agencies to preserve digital records in approved long-term formats, and PDF/A is one of the formats routinely endorsed for text-based records. State bodies such as Public Record Office Victoria and State Records NSW apply equivalent expectations, and many legal practices in Sydney and Melbourne, mining companies in Perth, and universities across the country inherit those obligations through funding agreements. When conversion fails or is skipped, records cannot be presented as compliant, and the organisation's broader recordkeeping policy falls out of step with its regulator.
Most teams misunderstand what kind of protection sits on their PDFs. A user password blocks the file from being opened and remains an essential security control. An owner password governs editing and modification rights while still letting anyone with the file open and view it. PDF/A conversion tools frequently cannot proceed when an owner password is active, even though the content is technically accessible. Distinguishing between these two layers is the first conceptual step in any archival remediation project.
Local processing also matters here. Australian government guidance around digital sovereignty encourages agencies and their contractors to keep sensitive record material on infrastructure they control. A workflow that decrypts a PDF locally, then passes the unprotected version straight into a verified converter, fits that model and avoids uploading restricted records to overseas servers. The end-to-end pattern of decrypt, validate, convert, and audit keeps the workflow auditable and reduces the chance of a record being quietly rejected at the final stage.
What PDF/A compliance actually requires
The PDF/A specification is a constrained subset of the PDF standard. It forbids features that depend on resources outside the document itself: JavaScript actions, external font references, encryption, and certain types of interactive content are all excluded. The goal is for the file to be self-contained, so a future reader does not need the original font library, application, or network connection to render the document exactly as saved.
There are several conformance levels under the ISO 19005 family. PDF/A-1b guarantees that the visual appearance is preserved. PDF/A-1a adds a structural requirement that the document be tagged so its logical reading order can be recovered. PDF/A-2 introduced JPEG 2000 support and improved transparency handling, while PDF/A-3 permits embedded files alongside a PDF report. Most Australian agencies default to PDF/A-1a or PDF/A-2a for text-heavy records, but the precise level matters less than the principle: anything that prevents reliable rendering must be removed.
Encryption and permission flags are explicitly prohibited by the standard. A file that opens but refuses to let the converter inspect its content stream, or prevents a validator from reaching its metadata tree, will fail conformance checks regardless of how carefully the rest of the file has been constructed. This is where the owner-password restriction becomes a direct obstacle rather than a minor inconvenience.
How owner-password restrictions block PDF/A conversion
Permission flags in a PDF live in the same encryption dictionary that governs open-password security, even when the file can be opened without entering a password. These flags dictate whether the user can modify text, fill forms, add annotations, or print the document. A PDF/A converter typically needs to write a new XMP metadata stream into the file, normalise font references, and sometimes re-save the document structure. None of those operations are possible while permission flags are active.
In practice, organisations hit this wall in three common ways. The converter simply aborts with a permissions error and refuses to touch the file. Or the converter appears to work but produces a non-conformant file that fails validation because part of the metadata could not be rewritten. Or the converter succeeds at producing a PDF/A-shaped file, but downstream validators such as veraPDF or the Apache Preflight library flag residual permission markers and reject the output.
These are the cases that practitioners describe when they ring the helpdesk at PDF Decrypter Pro, often with files received from external counsel or former employees whose permission setup was never updated. A clear walkthrough of removing read-only restrictions covers the technical mechanics, and most teams find that the removal step takes seconds once the right tool is in place.
Risks of skipping the decryption step
Skipping the decryption stage is tempting. A team is already running late on a records disposal schedule, the converter appears to have produced a file, and the file looks reasonable on screen. Yet that file may not be compliant, and the consequences only surface during an audit. The National Archives of Australia, Public Record Office Victoria, and similar bodies can request evidence that digital records have been migrated to approved formats, and a non-conformant PDF/A does not satisfy that request even if it looks fine.
There are downstream risks to the document itself. Metadata can be silently lost during a constrained conversion. Visual appearance may shift if fonts cannot be embedded properly while permission flags are still active. Form fields and annotations may disappear because the converter cannot read or rewrite them. For legal firms in Sydney's litigation market, mining companies preserving tenement records in Western Australia, and government agencies handling Freedom of Information requests, each outcome creates a recoverable compliance failure that is cheaper to fix at the start than months later, after records have already been declared migrated.
Some validators will quietly downgrade conformance when they encounter restricted source material, and the resulting file will pass superficial checks while failing structural ones. A file that opens on a workstation but fails veraPDF at the XMP level is still a non-conformant record, and downstream systems that rely on PDF/A inputs such as court filing portals and tribunal lodgement systems will reject the submission without explanation.
The decryption-to-conversion workflow
A reliable workflow has four stages and treats the original file as evidence throughout. First, the original PDF is copied into a working folder and a manifest is created so the source is not modified. Second, owner-password restrictions are removed using a local tool such as PDF Decrypter Pro, which works on Windows and macOS without uploading the file to a remote service. Third, the unrestricted file is passed to a verified PDF/A converter configured to produce the required profile, usually 1a or 2a, and the converted file is run through an independent validator.
| Stage | Restricted PDF | Decrypted PDF |
|---|---|---|
| Open and view | Allowed | Allowed |
| Modify or annotate | Blocked | Allowed |
| Run PDF/A converter | Fails or produces invalid output | Produces valid output |
| Pass veraPDF validation | Fails conformance check | Passes when correctly converted |
| Metadata rewrite | Partial or refused | Full |
| Audit outcome | Likely rejected | Likely accepted |
The benefit of local processing is worth restating. Files that contain personal information, financial records, or culturally significant content, including records held by Aboriginal and Torres Strait Islander organisations under protocols recognised by the Australian Institute of Aboriginal and Torres Strait Islander Studies, should not be sent to overseas servers during routine archival work. A tool that decrypts on the user's own machine keeps that boundary intact, and the same machine can host the converter and the validator so the chain of custody remains visible.
Where files arrive from external parties in a corrupted or partially restricted state, teams often need a more thorough recovery step before conversion can begin. The guide to restoring editing permissions walks through that recovery in detail, and it is worth bookmarking for any archival team that regularly receives material from outside their own network.
Maintaining metadata and audit trails through conversion
Decryption alone does not deliver compliance. The metadata that survives the journey from source file to PDF/A is just as important as the visual content. The National Archives of Australia recordkeeping metadata standard, the Victorian Electronic Records Strategy, and AS/NZS ISO 16175 expect certain descriptive, structural, and provenance fields to travel with a document across format migrations. PDF/A-1a and PDF/A-2a support XMP metadata streams precisely so those fields can be carried forward.
In practice, this means the workflow should capture the original filename, hash, owner-password status, decryption timestamp, converter version, and validator outcome as a written log. Each PDF/A output should be hashed and stored alongside its source file so an auditor can demonstrate that the converted record represents the original. Tools like PDF Decrypter Pro make the decryption step auditable because they report what was removed and when, and the downstream converter should be configured to log equivalent information about its own pass.
For federal agencies working under the Digital Continuity 2020 policy, that audit trail is not optional. The policy expects agencies to demonstrate, on request, that any record claimed to be in long-term preservation is in fact a valid copy of the original. Building the log into the workflow from the start turns a compliance headache into a routine administrative step that the whole team can follow.
When a document is destined for long-term retention, the order of operations matters. Restrictions should be removed first, the result validated independently, the converter run on a copy rather than the original, and the entire sequence recorded. Doing the decryption after conversion produces nothing useful; doing it before produces a clean archival copy that can be defended in any future audit, from a state records authority through to a Commonwealth administrative review.