diff --git a/ChangeLog b/ChangeLog
index a9b6a75e..0508a729 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,7 @@
 - configure fails for requested but unmet dependencies [remicollet]
 - add support for another quantiser [DarthSim]
 - jpeg2000 load left-justifies bitdepth
+- add "password" option to pdfload
 
 26/11/21 started 8.12.3
 - better arg checking for hist_find_ndim [travisbell]
diff --git a/libvips/foreign/popplerload.c b/libvips/foreign/popplerload.c
index 12fc5899..069cc75c 100644
--- a/libvips/foreign/popplerload.c
+++ b/libvips/foreign/popplerload.c
@@ -122,6 +122,10 @@ typedef struct _VipsForeignLoadPdf {
 	 */
 	VipsArrayDouble *background;
 
+	/* Decrypt with this.
+	 */
+	const char *password;
+
 	/* Poppler is not thread-safe, so we run inside a single-threaded
 	 * cache. On the plus side, this means we only need one @page pointer,
 	 * even though we change this during _generate().
@@ -182,7 +186,7 @@ vips_foreign_load_pdf_build( VipsObject *object )
 
 	pdf->stream = vips_g_input_stream_new_from_source( pdf->source );
 	if( !(pdf->doc = poppler_document_new_from_stream( pdf->stream, 
-		vips_source_length( pdf->source ), NULL, NULL, &error )) ) { 
+		vips_source_length( pdf->source ), pdf->password, NULL, &error )) ) { 
 		vips_g_error( &error );
 		return( -1 ); 
 	}
@@ -556,6 +560,13 @@ vips_foreign_load_pdf_class_init( VipsForeignLoadPdfClass *class )
 		G_STRUCT_OFFSET( VipsForeignLoadPdf, background ),
 		VIPS_TYPE_ARRAY_DOUBLE );
 
+	VIPS_ARG_STRING( class, "password", 25, 
+		_( "Password" ), 
+		_( "Decrypt with this password" ),
+		VIPS_ARGUMENT_OPTIONAL_INPUT,
+		G_STRUCT_OFFSET( VipsForeignLoadPdf, password ),
+		NULL );
+
 }
 
 static void