diff --git a/cpdfcommand.ml b/cpdfcommand.ml
index 0cb2bc5..b607323 100644
--- a/cpdfcommand.ml
+++ b/cpdfcommand.ml
@@ -1943,13 +1943,14 @@ let really_write_pdf ?(encryption = None) ?(is_decompress=false) mk_id pdf outna
           if args.debugcrypt then Printf.printf "Recrypting in really_write_pdf\n";
           match args.inputs with
             [] -> raise (Pdf.PDFError "no input in recryption")
-          | (_, _, _, user_pw, _)::_ ->
-              Pdfwrite.pdf_to_file_options
-                ~preserve_objstm:args.preserve_objstm
-                ~generate_objstm:args.create_objstm
-                ~compress_objstm:(not is_decompress)
-                ~recrypt:(Some user_pw)
-                false None mk_id pdf outname'
+          | (_, _, _, user_pw, owner_pw)::_ ->
+              let best_password = if owner_pw <> "" then owner_pw else user_pw in
+                Pdfwrite.pdf_to_file_options
+                  ~preserve_objstm:args.preserve_objstm
+                  ~generate_objstm:args.create_objstm
+                  ~compress_objstm:(not is_decompress)
+                  ~recrypt:(Some best_password)
+                  false None mk_id pdf outname'
         end
       else
         begin