Sharing a PDF is easy. Sharing it securely — so only the intended recipient can open it and no third party sees the contents — takes a few extra steps. Here is the workflow.
Emailing a PDF is the default way to share a document, and it is also the default way to leak one. Attachments sit on mail servers, get cached on multiple devices, and live in sent folders long after the conversation ends. For anything sensitive — a contract, an invoice, a scanned ID — a little structure around the sharing process removes most of the risk.
Step 1: Minimise what is in the file
Before protecting a document, reduce what it contains. Trim the pages the recipient does not need with Organize & Delete PDF Pages or extract only the relevant range with Split PDF. A five-page contract excerpt carries less risk than the full forty-page master agreement, and the pages you keep are never re-rendered, so quality is preserved exactly.
Step 2: Redact information the recipient should not see
If the document contains data the recipient does not need — account numbers, internal notes, other clients’ names — remove it before sharing. True redaction means deleting the underlying text and images, not drawing a black box over them. A black rectangle in a PDF viewer is trivially removable, and the hidden text underneath is still selectable, searchable, and copyable. Redact at the source, then re-export.
Step 3: Encrypt with a strong password
Apply AES-256 encryption with a user password so only someone who has the password can open the file. Use a long, randomly generated password and share it through a different channel than the document itself — send the PDF by email and the password by a messaging app, or read it over a call. Sending the file and its password in the same message defeats the purpose of encrypting it.
Step 4: Set permissions if appropriate
If the recipient only needs to read the document, set an owner password that disables printing, copying, and editing. Remember that permission flags are advisory — a determined reader can bypass them — so treat permissions as a deterrent, not a guarantee. The encryption is the real boundary.
Step 5: Use a browser-based workflow
Every step above — splitting, redacting, encrypting — can run entirely in your browser. Tools like the PDF Compressor and Unlock PDF parse and reassemble files locally using WebAssembly, so the document never travels to a remote server. When the file you are sharing is the kind of file you are sharing precisely because it is private, processing it on a third-party server is the wrong move.
What to avoid
- Do not share the password in the same message as the file. Use a second channel.
- Do not reuse passwords across documents. A single leak should not unlock everything.
- Do not rely on “view-only” link services for sensitive content. They often cache the file server-side.
- Do not draw black boxes over text and call it redaction. Remove the content.
- Do not forward encrypted files without checking what permissions travel with them.
After sharing
Once the recipient has confirmed they have opened the file, delete the local copy from your downloads and sent items if you no longer need it. If you shared a time-limited document, set a reminder to ask the recipient to delete it when the purpose has passed. Good sharing hygiene is mostly about reducing the number of places a sensitive file exists, not about adding more locks.
A note on access logs and forwarding
Even a perfectly encrypted PDF can be undermined by the channel it travels through. Corporate email systems log attachments, cloud sharing services record who viewed a link and when, and a recipient can always forward or screenshot a document once they have the password. Encryption guarantees that no one without the password can read the file in transit or at rest — it does not guarantee that a recipient will keep it private. For genuinely high-stakes documents, pair encryption with a clear understanding with the recipient about retention, and prefer a direct handoff over a stored channel. The goal is to make the set of people who could ever access the content as small as the set of people who need to.