The safest way to send sensitive documents by email is to prepare the file before you attach it. Remove details the recipient does not need, save the document as a PDF, lock it with an open password using Protect PDF, and give the password through a different channel such as a phone call. Then check the address twice before you press send.
Email is convenient, but a message can be forwarded, opened on a shared computer or sent to the wrong person. You cannot control the inbox at the other end. What you can control is the attachment.
What makes email risky for private papers
- Wrong recipient. Autocomplete picks a similar name and your salary slip goes to a stranger.
- Forwarding. The recipient passes your message to a colleague, and then it is in several inboxes.
- Shared or old accounts. Office inboxes are often read by more than one person, and old emails sit there for years.
- Lost or borrowed devices. A phone with an open mail app shows every attachment ever received.
A password on the PDF helps with all four, because the attachment stays locked wherever the email ends up.
How to send sensitive documents by email step by step
- Ask what is really needed. If the landlord wants proof of income, they may not need six months of every transaction. Send the minimum.
- Remove what is not needed. Use Redact PDF to draw boxes or search words to black out. Redacted pages are flattened, so the hidden text is actually removed. For statements, follow our guide on how to hide account numbers in a bank statement PDF.
- Clean the document details. Title, author and keywords can carry names you did not mean to share. View and change them with Edit Metadata.
- Add an open password. Open the Protect PDF tool, add your file and type a password. You can also choose whether printing, copying and editing are allowed. Download the protected copy.
- Test the locked file. Open the download yourself. It should ask for the password and open correctly when you type it.
- Attach the protected copy. Give it a neutral file name. Check you have attached the locked version, not the original.
- Send the password another way. Tell the recipient by phone or in person, or through a different messaging app. Never put it in the same email.
- Confirm receipt. Ask the recipient to confirm they opened it. Then you know it reached the right person.
Choosing and sharing the password
The lock is only as good as the password. A date of birth or a phone number is easy to guess for anyone who knows a little about you. Use a long password made of several unrelated words, and do not reuse the one from your email account. Our guide on how to choose a strong password for a PDF has simple methods you can remember.
How you share it matters just as much. If the password travels in the same email as the file, anyone who gets the email gets both. A second channel means an attacker would need access to two separate places.
| Way to share the password | How good is it? |
|---|---|
| In the same email as the file | Poor. It defeats the purpose. |
| In a second email to the same address | Weak. Both sit in one inbox. |
| By text message or chat app | Good. It is a separate channel. |
| By phone call or in person | Best. Nothing is written down. |
| Agreed in advance for regular exchanges | Good, if you change it from time to time. |
Redact, protect, or both
These two tools solve different problems. Redaction decides what the recipient can see. A password decides who can open the file.
- Redact only: when the document will be widely shared and certain details must never be visible, for example a sample invoice.
- Protect only: when the recipient needs the full document, such as a signed contract or a complete application form.
- Both: for statements, ID copies and medical reports, where some details are irrelevant and the rest is still private.
Always redact first and add the password last. Remember that once the recipient opens the file with the password, they can read everything that remains, so redaction is your only control over that.
Final checklist before you press send
- Is this the right recipient, and did you type the address yourself or confirm it?
- Is the attachment the redacted, password-protected copy?
- Does the file name avoid private details?
- Is the subject line neutral? “Documents as requested” is better than a line with your ID number in it.
- Is the password absent from the email body?
- Is the file within the recipient’s size limit? Check the limit shown by your email service. If the file is too big, Compress PDF can reduce image-heavy files, and you should compress before adding the password.
- Did you tell the recipient how they will get the password?
If you sent it to the wrong person
Act quickly. Some email services offer a short window to undo a send, so try that first. If it is too late, write to the wrong recipient, ask them to delete the message, and do not send them the password. If the file was locked and the password went by another channel, the damage is limited. If it contained bank or ID details without protection, consider informing your bank or the relevant office.
Signed agreements deserve the same care. If you are emailing a contract you signed on screen, it helps to understand whether electronic signatures are legally valid, since rules differ by country and organisation.
Frequently asked questions
Is it safe to send a passport copy by email?
It carries risk, so send it only to a recipient you have verified and only when they truly need it. Put the copy in a password-protected PDF, share the password separately and ask them to confirm receipt. Requirements differ between organisations, so follow the instructions of the office that asked.
Should I zip the file or password protect the PDF?
A password on the PDF itself is usually simpler for the recipient, because the file opens in any PDF viewer on a phone or computer after they enter the password, with no extra app needed.
Can the recipient remove the password from my PDF?
Yes. Anyone who knows the password can open the file and save an unlocked copy. A password protects the document on its journey and from people who do not have the password. It does not control what a trusted recipient does afterwards.
Does a PDF tool see my document when I add a password?
That depends on the tool. PDFNova processes files in your browser, so your documents are not uploaded to a server.
Sending private papers by email does not have to be a worry. Trim the document, lock it and share the password separately. Start with Protect PDF and your attachment will be ready in a minute.