Why Adding a Password Before Emailing a PDF Is a Smart Precaution
Email is not a secure communication channel. An email message passes through multiple servers between the sender and the recipient, and at each hop, the message content, including any attached PDF files, is stored temporarily and potentially accessible to server administrators. Adding a password to a PDF before attaching it to an email ensures that even if the email is intercepted or accessed by someone other than the intended recipient, the document content remains protected.
Communicating the password through a different channel than the email is the single most important security practice.
The encryption standard your PDF tool uses directly determines how resistant the document is to unauthorized access.
Password protection is particularly important for documents containing personal information, financial data, legal communications, or business-sensitive content. A tax return sent to an accountant, a contract sent to a client, or a medical record sent to a doctor all benefit from the additional security layer that password protection provides. The password should be communicated to the recipient through a different channel than the email containing the protected PDF, such as by phone, text message, or a separate email sent to a different address.
PDF Security through password protection is not unbreakable, but it provides a strong practical barrier against casual unauthorized access. A password-protected PDF encrypted with AES-256 encryption, the standard used by modern PDF tools, would take billions of years to crack by brute force with current computing technology, assuming a strong password of reasonable length. The practical security of password-protected PDFs is limited not by the encryption strength but by the strength of the password chosen and the security of the separate channel used to share it.
Step-by-Step: Adding a Password to a PDF Before Emailing
Adding password protection to a PDF before sending it by email takes about 30 seconds in most PDF tools. Open the PDF in your preferred PDF Password protection tool. Locate the security or protect function, which is typically found under File, Tools, or a Protect menu option. Select the option to add password protection, which opens a dialog where you enter the password you want to use.
Most password protection tools offer two separate passwords: an open password and a permissions password. The open password is required to view the document at all. The permissions password controls what the recipient can do with the document after opening it, such as whether they can print it, copy text from it, or edit it. For email attachments, the open password is the one that protects against unauthorized access. The permissions password provides additional control over what authorized recipients can do with the document after they open it.
Choose a password that the recipient can remember or easily retrieve from the separate channel you will use to share it. A password like a short phrase with a number, such as the recipient's zip code combined with a word related to the document topic, is practical. Avoid using the recipient's name, birth date, or other easily guessed information as the sole password component. After entering and confirming the password, save the protected PDF. Verify that the protection works by closing and reopening the file, which should prompt for the password before displaying any content.
After verifying the protection, attach the protected PDF to your email and send it. Then communicate the password to the recipient through your chosen separate channel. Do not include the password in the same email as the protected PDF, as this defeats the purpose of password protection entirely. A separate communication channel ensures that someone who gains access to the email still cannot open the attachment.
Choosing a Tool for Password-Protecting PDFs on Different Devices
On a Windows computer, Adobe Acrobat Reader can add password protection to PDFs, as can Microsoft Print to PDF when combined with the destination PDF editor. Most third-party PDF tools for Windows also include password protection features. The built-in options vary by Windows version, so check what your specific version supports before installing additional software.
On a Mac, the built-in Preview application does not support adding password protection, but the ColorSync Utility and several free third-party Mac PDF tools do. PDF Expert and PDFpen both offer password protection among their features. For occasional use, a browser-based tool that processes the PDF locally avoids the need to install any software.
On iPhone and Android, password protection is available through PDF editing apps. Apple's built-in tools do not include PDF password protection, so a third-party app or a browser-based tool is needed. The process is similar across mobile platforms: open the PDF in the app, select the protect or security option, enter and confirm the password, and save the protected version.
WukongPDF's PDF Security tool works in any browser on any device, adding AES-256 password protection to PDFs without software installation. Upload the PDF, enter the password, and download the protected file. The tool processes the file in memory and does not store the original or protected versions on its servers after the operation completes.
What Makes a Good PDF Password and How to Share It Securely
A good PDF password balances security against practicality. A 16-character random string of letters, numbers, and symbols is extremely secure but impractical to communicate and for the recipient to type. A password composed of several unrelated words with a number, such as the combination of a color, an animal, and a three-digit number the recipient knows, is far easier to communicate by phone and to type correctly on the first attempt while still providing adequate security for most document protection scenarios.
The method you use to share the password should be separate from the email that carries the protected PDF. A phone call is ideal because it confirms the recipient's identity through voice recognition. A text message to the recipient's known phone number is convenient and reasonably secure. A messaging app with end-to-end encryption, such as Signal or WhatsApp, is also suitable. Avoid sharing the password through the same email account that sent the protected PDF, through unencrypted chat applications, or through any channel where the password could be intercepted alongside the document it protects.
The strength of PDF password encryption has improved significantly over the years, and understanding which encryption level your tool uses helps you make informed security decisions. Modern PDF tools that support AES-256 encryption provide protection that meets current cryptographic standards. Older tools or basic converters that only support RC4 encryption, an older and weaker algorithm, provide significantly less protection against determined attackers. Check your PDF tool's documentation or security settings to confirm which encryption standard it applies. If AES-256 is available, use it.
After the recipient has confirmed receiving and opening the protected PDF, consider changing the password or removing the protection if the document no longer needs to be secured in transit. A password-protected PDF sitting in the recipient's email inbox or downloads folder is protected against casual access, but the password remains a point of friction every time the recipient needs to open the document. Removing the protection after successful delivery restores convenient access while the document was protected during the riskiest phase of its journey, the transit through email servers between sender and recipient.
For recurring document exchanges with the same recipient, such as weekly reports to a client or monthly statements to an accountant, establish a shared password protocol that you use consistently. The recipient knows the password and does not need a separate communication each time, but the password still protects each individual document during transit. A shared password that changes quarterly provides a balance between security, through periodic password rotation, and convenience, through not requiring a separate password communication for every document exchange.
Organizations with formal information security policies should verify that their PDF password protection practices align with those policies. Some policies require specific encryption standards, minimum password complexity rules, or approved tools for applying protection. Using a personal PDF tool to password-protect a document containing business-sensitive information may satisfy the practical goal of securing the document but violate a policy requirement to use an approved enterprise tool. Check your organization's policy before standardizing on a particular PDF protection method for business documents.
When you receive a password-protected PDF from someone else, the responsibility for keeping the password secure shifts to you. Store the password in a password manager rather than in your email inbox, where it sits alongside the protected PDF and defeats the purpose of separate-channel communication. Most password managers allow you to attach notes and files to password entries, so you can link the password entry to the protected PDF file for convenient access without compromising the security separation between the document and its password.
Many PDF tools also offer certificate-based encryption as an alternative to password-based encryption. Certificate encryption uses digital certificates instead of passwords, which eliminates the password communication problem because the recipient already possesses the certificate needed to decrypt the document. Certificate-based security is more complex to set up initially but provides stronger ongoing security for recurring document exchanges with the same recipients.
Taking these few extra minutes to protect sensitive documents before sending them by email is a habit that, once established, becomes as automatic as attaching the file itself, and it provides peace of mind that is disproportionate to the small effort involved.