How to open a password protected bank statement PDF
Why banks lock statement PDFs, how the password is usually built, what to do without it, and how to analyse a locked file without saving an unlocked copy.
By Karchu Editorial Team, reviewed against our editorial standards
If your bank emails statements, the attachment is almost certainly encrypted. That is a good thing: email is not a private channel, and an intercepted attachment that cannot be opened is worth nothing to whoever intercepted it. It becomes annoying only when you want to actually use the file.
Find the password before you guess
Banks do not invent passwords. They derive them from information you already have and spell out the recipe in the covering email or in the online banking help pages. The usual patterns are:
- The first four or five letters of your name in capitals, followed by your date of birth as DDMM or DDMMYYYY.
- Your customer identification or account number, sometimes only the last digits.
- A tax identifier such as a PAN, occasionally in lower case.
- Date of birth combined with the last digits of the registered mobile number.
- For card statements, the card number's last digits with your birth date.
Read the email first. Several banks lock the document or the channel after a handful of failed attempts, so working through combinations is a bad plan.
What not to do
Do not upload a statement to an anonymous online unlocking site. You would be handing a complete record of your finances, plus the password, to a service with no accountability. Do not email an unlocked copy to yourself either, which recreates exactly the risk the password existed to prevent.
Opening it properly
- Open the PDF in your normal reader and enter the password from the bank's email.
- If you need a permanent unprotected copy, produce it locally and store it somewhere private, not in a shared downloads folder.
- Better still, keep the file locked and use a tool that accepts the password when it reads the file.
Analysing a locked statement without unlocking it first
Karchu takes the third option. Upload the protected PDF as your bank sent it and you are prompted for the password when the file is opened. With several locked files, you are asked once per file, with the file name shown. The password is kept in the browser tab's memory for the session, so a re analysis of the same document does not ask again, and it is never written to storage, sent to a server or logged. The full behaviour is described on the password protected statements page.
The two cases that still need an unlocked copy
A locked PDF that is also a scan has to be read with OCR on the server, which does not receive the password, so that file needs an unlocked copy. Encrypted spreadsheets cannot be opened in the browser at all, so save an unprotected copy of an XLS or XLSX before uploading. Everything else about spreadsheet imports is on the CSV and spreadsheet converter page.
Frequently asked questions
- What is the password on a bank statement PDF?
- Banks derive it from details you already hold and describe the format in the email that carried the statement. Common patterns are the first letters of your name with your date of birth, your customer or account number, or a tax identifier such as a PAN.
- Is it safe to remove the password?
- Removing it produces an unprotected copy of a sensitive document that then sits in your downloads folder. It is safer to keep the file locked and use a tool that accepts the password at the point of reading.
- Can I recover a statement password I never knew?
- Not by guessing. Ask the bank or download an unprotected copy from online banking. Repeated wrong attempts can lock the document or the channel.
- Does Karchu keep my PDF password?
- No. It is held only in the memory of the browser tab, is never stored, sent to a server or logged, and is cleared when the tab is closed or reloaded.