Why you should never email a PDF password with the PDF

If you attach a password-protected PDF to an email and put its password in the same message, anyone who can read that email gets both. The file may be encrypted, but keeping the key beside it in the same inbox defeats much of the reason for setting a password.

Send the PDF and its password through separate channels. That way, someone who gets access to only one message or account still may not be able to open the document.

Why sending both together is risky

A password protects the PDF file itself. It does not protect the email account, the recipient's inbox, or every place where a copy of the email may be stored. If someone gains access to the mailbox, they can find the attachment and the password together.

The same problem can arise if an email is forwarded, a shared inbox is used, or someone else can see notifications on a device. A password in the email body, subject line, or a second message in the same email thread is still easy to find alongside the PDF.

Using separate channels reduces the chance that one compromised account exposes both pieces. It does not make sharing risk-free, but it adds a useful barrier.

How to send a protected PDF more safely

1. Use Protect PDF to add a password to the document. It works on the file in your browser, so the PDF is not uploaded.
2. Choose a strong, unique password that you have not used for another account or document. A longer passphrase made from unrelated words is easier to remember than a short, predictable password.
3. Save the protected PDF as a separate copy. Keep the original in a safe place in case you need to make changes or recover from a sharing mistake.
4. Confirm the recipient and email address before attaching the file. Send the PDF without including its password anywhere in that email.
5. Share the password through a different channel the recipient can access, such as a phone call to a number you already know. Avoid sending it in a reply to the same email thread or to another address that opens in the same mailbox.
6. Tell the recipient which file the password belongs to, but do not include the password in the file name or an unprotected note stored alongside the PDF.

For sensitive documents, agree on the sharing method with the recipient before sending anything. Use a channel that is appropriate for the information and that the recipient can verify. If the recipient's email or phone account may also be compromised, choose another trusted method.

What a PDF password does and does not protect

A password can prevent someone who gets a copy of the protected file from opening it without the password. It is useful if an attachment is accidentally forwarded or saved in the wrong place, as long as the password is kept separate and remains secret.

It cannot control what happens after an authorized person opens the document. They may be able to save another copy, take a screenshot, photograph the screen, or share the password. Limits on printing, copying, or editing can discourage some actions, but they should not be treated as a guarantee that a recipient or every PDF app will enforce them.

For that reason, use a password as one layer of protection, not as a substitute for choosing the right recipient and sharing only the pages or information they need. If a document contains highly sensitive details, follow your workplace or organization's approved sharing process.

What to do if you already sent both

If the PDF and its password went in the same email, act based on how sensitive the document is. If the message is still in your outbox, you can try to stop it, but do not assume that recalling an email will remove it from the recipient's inbox or other copies.

1. Contact the recipient using a separate channel and ask them not to forward the message or PDF. If appropriate, ask them to delete the email and attachment.
2. If the document is still in your control, make a new protected copy with a different password and share the new password separately. Do not reuse the exposed password for another document or account.
3. If the document includes work, financial, medical, or personal information, follow the relevant reporting or incident process. The right response depends on the document and your organization's rules.

Changing the password on a new copy does not make the old attachment disappear. Treat the original password and file as potentially exposed if the email reached someone who should not have access.

Make passwords easier to manage safely

Use a different password for each protected PDF, especially when the files contain private information. Store it in a reputable password manager if you need to keep a record, and share it only with people who are meant to open the document. Do not put it in a document labeled with the same file name and send that document beside the PDF.

If the recipient needs repeated access, agree on a secure way to share the password once rather than sending it repeatedly in email. You can also ask whether the recipient has a secure document-sharing process that better fits the sensitivity of the file.