How to password-protect a PDF before you send it

How to password-protect a PDF before you send it

If you must attach a sensitive document to an email, this is the mitigation. It is straightforward, and there is exactly one detail that determines whether it works at all.

The one thing that matters: which password

PDFs support two completely different kinds of password, and they are not equally useful.

The permissions password is a request to well-behaved software. It stops your recipient from accidentally printing a document. It stops an attacker from nothing.

Always choose the open password — the setting that makes the file ask for a password before it opens.

Verify it. Close the file, reopen it, and confirm you are prompted. If it opens straight away, the protection was not applied.

How to add one

Mac

1. Open the PDF in Preview.
2. File → Export as PDF.
3. Expand the options, tick Encrypt, and set a password.
4. Save as a new file, then close and reopen it to verify.

iPhone / iPad

1. Open the Files app and find the PDF.
2. Long-press the file and choose Lock PDF.
3. Set the password.

Android

Varies by manufacturer and PDF app. Several common PDF readers include a protect or encrypt option in their share or export menu.

Windows

Windows has no built-in PDF encryption. Use a PDF application that offers an open password, or a reputable offline tool.

Avoid free web-based "encrypt your PDF online" services. To use one, you upload the exact document you were trying to protect to a server run by someone you know nothing about, in a jurisdiction you did not choose. The tool that solves the problem creates a worse one.

Microsoft Office

If the source is a Word or Excel document, protect it before converting: File → Info → Protect Document → Encrypt with Password, then export to PDF, then re-protect the PDF if needed.

Choosing the password

• Use a passphrase — four or more unrelated words. Long beats complicated.
• Do not use a date of birth, a phone number, a postal code, the recipient's name, or the document's own subject. These are the first guesses, and for a document that contains a date of birth, using it as the password is self-defeating.
• Do not reuse a password you use anywhere else.
• Use a different password for each recipient, if you are sending to several.

Sending the password

This is where most people undo the whole exercise.

Send the password by a different channel from the file. A phone call. A text message. In person.

Never:

• in the same email
• in a follow-up email in the same thread
• in the filename (passport_pw_hunter2.pdf is not a strategy)
• in the email subject line

The reason is simple: the threat you are protecting against is someone with access to a mailbox. If both the file and the password are in that mailbox, they have both.

Where password protection stops helping

Be clear about what you have and have not achieved.

• It protects the file in transit and at rest — until the recipient opens it. Once they decrypt and save a copy, your protection is gone and their security practices are now yours.
• It does not stop the recipient from forwarding it, with the password.
• It does not limit retention. The document still sits in their systems for as long as their policy says, or longer.
• It does not give you a record of who opened it or when.
• A weak password gives weak protection, regardless of the encryption underneath.

For anything genuinely sensitive going to a business, an access-controlled channel with expiry and an audit trail is better on every one of those points — see How to send sensitive documents securely in Canada.

The step before this one

Before you encrypt anything, ask whether the recipient needs the document or the information inside it. Most requests for a "void cheque" want an account number; most requests for a passport scan want a name, date of birth and document number.

If a form needs the information, fill the form. Nothing needs to be attached, encrypted, or sent at all.

How my-id.ca helps

my-id.ca removes most of the reason to attach documents in the first place. Your saved profile fills web forms and PDFs directly, so details arrive where they are needed without a file changing hands — and when you fill a PDF in my-id.ca you can flatten it before sending, so your answers cannot be quietly edited afterwards.

When a business genuinely needs a document, they can request it through my-id.ca — an access-controlled channel that keeps a record of what you shared. Your files are encrypted, held on Canadian servers, and never sent to third-party AI providers.

Next steps

• How to send sensitive documents securely in Canada
• Is it safe to email your SIN, passport or ID?
• After you fill a PDF: download, flatten, save, send
• When a PDF has no form fields

Important: this is general information, not legal advice

This article is general information about handling your own documents — it is not legal, security, or financial advice, and my-id.ca does not provide legal or professional consultation. my-id.ca is not a government agency, law firm, lawyer, or licensed advisor, and is not affiliated with or endorsed by Apple, Microsoft, Adobe, Google, or any government body.

Software menus, features and security defaults change between versions and platforms. Verify that protection was actually applied by closing and reopening the file, and consult the vendor's current documentation. For advice about your individual circumstances, consult a qualified professional. If anything in this guide differs from an official source, the official source is correct.