What to start from

If you have no idea how long the password is and what characters it may contain, just run the dictionary-based attack first. If it fails, try brute-force attack up to 5-7 characters (depending on your computer speed, character set, PDF version etc); to estimate the speed of your computer (on your particular PDF file with the given settings), just use the Benchmark feature.

If brute-force attack also fails, you can try to use other (larger) wordlists and/or play with brute-force attack settings. But if your file uses 40-bit encryption, it is recommended to run the Key search attack – with it, success (decryption) is guaranteed, though it may take a few days. Using the pre-computer hash tables (available with APDFPR Enterprise), though, decryption is being done in just a few minutes.