Decrypt encrypted PDFs Using macOS Automator Quick Actions

Introduction

Some actions I have to do so rarely that I spend more time searching how to do them than actually completing them. One of these actions is decrypting encrypted PDFs. After a handful of occasions having to google HOW to do this, I thought I’d write an automator task to do it for me. I like to automate simple tasks like this to save time and avoid the need to Google them.

Allegedly you can use Preview to do this through the Export command but the supposed option that you are supposed to uncheck (encrypt) doesn’t appear in macOS 14.5. But who wants a manual solution anyway right? The intention is to have a script that can receive one or more PDFs, ask for a password then decrypt them all.

Prerequisites

In order to decrypt PDFs, you will need to install qpdf which is a command line tool that performs transformations on PDFs, one of those transformations is encryption/decryption. There is a Homebrew formula for it so it can be installed using the following command:

brew install qpdf

Automator

We want an Automator script that is available when a file is selected in Finder. To do this, we will create a new Quick Action in Automator. Open Automator and create a new Quick Action.

Next we need to set up the input for the Quick Action characteristics. Here are the changes to make:

1. In the search bar type shell.
2. Drag the “Run Shell Script” action to the right hand side of the Automator window.
3. In the “Workflow receives current” dropdown, select “PDF files”.
4. In the “in” dropdown next to the “Workflow receives current” dropdown, select “Finder”.
5. In the “Pass input” dropdown, select “as arguments”.

The Run Shell Script is self-explanatory, we are going to run a shell script! The Workflow receives current...in... context is informing Automator that we only want this Quick Action to be available when a PDF file is selected in Finder. The as arguments option will pass the selected PDF files to the shell script. This is important because we want to use the PDF file(s) selected as part of our decrypt command.

Initial script

Now for the script, I want to open a dialog box to ask for the password to decrypt the PDFs, then the script will use that password to decrypt the PDF. I also want to allow this script to work over multiple PDFs so I need to add a for each loop that will iterate over all selected files. Here is a starter script:

password=$(osascript -e 'tell app (path to frontmost application as text)
text returned of (display dialog "Enter password:" default answer "")
end')
for file in "$@"; do
	backupFile="${file%.*}-original.${file##*.}"
	cp "$file" "$backupFile"
	/opt/homebrew/bin/qpdf --decrypt --password="$password" "$backupFile" "$file"
  rm "$backupFile"
done

This script will ask for a password using a dialog box that will be displayed as the frontmost window. "$@" references the files that are passed in as arguments. So for each file, the script will then define a backup file name, rename the original to that filename, then decrypt the PDF as the original filename.

Testing

Once you have saved the script, you can test it by selecting a PDF file in Finder, right-clicking and selecting the Quick Action you created. A dialog box will appear asking for your password:

A backup of the original file will be created and the decrypted file will be saved to the original filename:

Now I have one less thing to Google!

Refined script

When you are happy that the script works as expected, you can change it to this:

password=$(osascript -e 'tell app (path to frontmost application as text)
text returned of (display dialog "Enter password:" default answer "")
end')
for file in "$@"; do
	/opt/homebrew/bin/qpdf --decrypt --password="$password" "$file" --replace-input
done

Rather than creating a backup, I have added the --replace-input argument allowing the script to simply decrypt the PDF and overwrite the original file.

Alternative script

I have intentionally set this script up to accept a single password and decrypt all selected PDFs using that same password. This is the scenario that would be most useful to me. If you want to be able to enter a different password for each PDF, you could modify the script to ask for the password for each file. Here is an example:

for file in "$@"; do
  password=$(osascript -e 'tell app (path to frontmost application as text)
  text returned of (display dialog "Enter password:" default answer "")
  end')
	/opt/homebrew/bin/qpdf --decrypt --password="$password" "$file" --replace-input
done

Whilst iterating through each file, it will open a dialog box and ask for a password and then decrypt the PDF using that given password. I did a quick test, the only downside during my very quick test was that I couldn’t get the dialog box to tell me which file was being decrypted. My assumption would be that they handled in alphabetical order but maybe this isn’t guranteed. Since I’m not going to use this version, I’m not going to worry about it. If you work it out, let me know in the comments!

Wrapping Up

Automator is a powerful tool that can be used to automate simple tasks on macOS. In this example, we created a Quick Action that decrypts selected PDF files using a password. This script can be modified to suit your needs, for example, you could add a notification to inform the user that the decryption has been successful. I hope this post has been helpful, if you have any questions or suggestions, please leave a comment below.

References

• Homebrew formula for qpdf
• qpdf documentation