Email was not designed to be confidential. A message and its attachment sit in your sent folder, on your mail provider’s servers, on the recipient’s provider’s servers, in their inbox, on their phone, and in every backup of all of those. Forwarding takes one click and doesn’t ask permission.
For a lunch invitation, fine. For a payslip, a passport scan, a signed contract, or a medical letter, worth ten seconds of protection.
Encrypt the file itself
Lock PDF adds a password using AES-256 encryption — the same modern standard used to protect sensitive files generally. The document can’t be opened, read, or printed without the password you set, and it works in any PDF reader on Windows, Mac, iPhone, and Android.
The value of encrypting the file rather than trusting the channel is that the protection travels with the document. It’s still encrypted after it’s been forwarded, downloaded to a laptop, or synced to a phone.
Send the password another way
This is the part people skip, and it undoes everything. A password in the same email — or in a follow-up email to the same address — protects against nothing, because anyone who has one message has both.
Use a different channel: a text message, a phone call, a chat app, or a password the recipient already knows and you never transmit at all (their employee number, the last four digits of a reference you both hold).
Choosing the password
- Not the document’s own contents. “Your date of birth” is a convention with statements, and it’s a weak one — it’s on the payslip inside.
- Long beats complicated. Three unrelated words are stronger and far easier to read down a phone line than
Xk9#p2. - Different for different recipients. One password for everything means one leak exposes everything.
- Write it down before you send it. There is no back door: a locked PDF cannot be opened or recovered without its password. Not by us, not by anyone.
Also clear the metadata
Encryption protects the contents from strangers. It doesn’t hide what the file says about you from the person you’re sending it to. A PDF’s properties can carry the original author’s name, an internal project name, and the software and machine that produced it — often surprising things when the document has been through several hands.
View and edit the PDF’s metadata before sending anything outside your organisation, and clear the fields you don’t want travelling with it.
Send only what they need
The most effective privacy measure isn’t cryptographic. If they asked for one payslip, don’t send the twelve-page annual bundle: split the PDF or delete the other pages first. If they need proof of address, they don’t need every transaction on the statement.
Practical notes
- Already-protected file? Unlock it with its current password first, then lock it again with yours.
- Not a PDF yet? Convert it first — Word, Excel, PowerPoint, or images — then lock the PDF.
- Scanning an ID right now? Scan to PDF can set a password as part of the same pass.
- Over 25 MB? Compress it first; a smaller file is easier to share once locked.
- Any normal PDF can be locked, including a scan — the content doesn’t matter, the whole file is encrypted.
Ready? Try the free Lock PDF tool now — no sign-up, no watermark, and your file is never stored.