How to Send Sensitive Documents Safely by Email or Chat

To send a sensitive document safely, send only the pages that are needed, password-protect the PDF, share the password through a different channel (a phone call or text, not the same email), double-check the recipient, and delete copies you no longer need afterwards. None of these steps needs special software. ToolMany's PDF password tool adds AES-256 encryption in your browser, without uploading the file.

This guide is for everyday situations: sending an ID scan to a landlord, bank statements to an accountant, a signed contract to a client, or medical letters to an insurer. It is not a guide for handling classified or regulated data at work; follow your employer's rules for that.

Why ordinary email is not private by default

Email is convenient, not secret. A message usually passes through several servers and stays in at least two mailboxes, yours and the recipient's, often for years. Attachments are copied into backups, forwarded, and downloaded onto phones. Most major providers encrypt the connection between servers, which protects against casual snooping on the network, but the file itself sits readable in both inboxes.

That means the real risks are mostly practical:

• sending to the wrong address (autocomplete is a common culprit);
• a mailbox being broken into later, exposing old attachments;
• the recipient forwarding the file further than you expected;
• a shared or lost device with the email app logged in.

Each step below reduces one of these risks.

Step 1: Send less

The safest data is data you never send.

• Only the pages asked for. If an agent needs proof of address, send the single statement page with your name and address, not the full six-month statement. Use Split PDF to extract just those pages.
• Cover what is not needed. On a bank statement used as proof of address, the transactions are usually irrelevant. On an ID card copy, some organisations accept a copy with the ID number partly covered. Ask first, because some do not.
• Add a purpose watermark. Writing "Copy for XYZ Lettings rental application, October 2026" across an ID scan makes it far less useful to anyone who tries to reuse it elsewhere. The PDF Watermark tool adds text like this to every page.

A note on covering information: drawing a black box over text in a PDF editor does not always remove the text underneath; it can sometimes still be selected and copied. For a reliable result, cover the area on an image (for example with the Image Editor or by scanning a physically covered copy) and then build the PDF from that image.

Step 2: Password-protect the PDF

Encryption means that anyone who gets the file without the password sees only scrambled data.

1. Open the PDF password tool and choose Lock.
2. Add the PDF and type a strong password: at least 12 characters, ideally a few random words, such as harbour-lemon-cactus-71.
3. Download the protected copy and test it: open it, and confirm it asks for the password.

ToolMany uses AES-256, the strongest standard PDF encryption. It works in all common PDF readers. If you need several documents protected together, first combine them with Merge PDF so the recipient handles one file and one password.

Our full guide on password-protecting a PDF covers choosing passwords and what PDF permissions can and cannot do.

Step 3: Send the password separately

A password in the same email as the file protects almost nothing; anyone who sees the email sees both.

• Best: tell the recipient by phone.
• Good: send it by text message or a different messaging app than the one carrying the file.
• Agree a pattern in advance with people you send to regularly, such as an accountant, so you do not need to share a password every time. Avoid obvious patterns like your date of birth.

Step 4: Check the recipient, then check again

Misaddressed email is one of the most common ways personal data leaks.

• Type the address rather than trusting autocomplete, or pick it from a previous email thread you know is genuine.
• Watch for lookalike domains: accounts@yourbank-support.com is not your bank.
• If you were asked for documents unexpectedly, especially by email, call the organisation on a number you found yourself (from their official website or a letter) to confirm the request is real. Requests for ID documents are a common scam.

Step 5: Choose the right channel

When an organisation offers its own upload portal, use it. It is usually the channel their processes are designed around.

Step 6: Clean up afterwards

• Delete the sent copy from your email if you do not need it, and remember the "Sent" folder.
• Remove the unprotected original from your Downloads folder and any phone gallery if you made a temporary scan.
• Revoke cloud sharing links when the recipient confirms they have the file.
• Keep one secure master copy of important documents, rather than many scattered ones.

Scanning sensitive documents

If you are making the scan yourself, a phone is usually good enough. Our guide to scanning documents with your phone covers lighting and flattening. Afterwards, check that the photo did not sync to a shared family album, and that you did not accidentally include other papers in the background.