How to Safely Share a Confidential PDF: A Checklist

Before a sensitive PDF leaves your hands, work through this list: cut it to the pages that are needed, redact properly, remove hidden data, mark it for the recipient, encrypt it, and choose how it travels. Most steps take a minute.

By Deresaw Tools · Updated 3 October 2026

Contracts, medical letters, bank statements, HR files, a passport scan for a landlord: PDFs are how sensitive documents travel. Leaks are rarely dramatic hacks. More often they are the wrong attachment, a “redacted” file whose text can still be copied, an author name in the metadata, or a document forwarded months later by someone you never meant to have it.

This checklist goes from the document itself to how it is delivered. Not every document needs every step. A payslip for a mortgage broker needs less than a disciplinary report. But it is worth knowing what each step protects against.

1. Send only the pages that are needed

The safest information is information you never send. If a landlord needs proof of income, they need one payslip page, not the whole year’s statements. Extract the relevant pages with Split PDF (for example 1-2, 5) and send that file instead of the original.

Also check you are attaching the right version. “contract_final_v3_REAL.pdf” next to “contract_final_v3.pdf” is how drafts with internal comments reach the other side.

2. Redact properly, or not at all

Drawing a black rectangle over text in most PDF editors does not remove the text. It adds a shape on top. The words underneath can still be selected, copied, searched and read by any program that extracts text. Court filings and government reports have leaked this way many times.

There are two reliable ways to redact:

• A real redaction tool, such as the Redact tool in Adobe Acrobat Pro, which deletes the content under the marked area and then lets you apply the redactions permanently.
• Flatten the pages to images. If you do not have a redaction tool, turn the pages into pictures, cover the sensitive parts on the pictures, and turn them back into a PDF. Nothing hidden survives, because the new file contains only the images. With free tools:
  1. Convert the pages to images with PDF to Image at 150 or 300 DPI.
  2. Open each image that needs redacting in Blur Image, drag a box over each sensitive area, choose Black box, and download.
  3. Combine the images back into one PDF with Image to PDF.
  The result cannot be searched or copied. That is the point: there is no text left to leak.

After redacting, open the final file, press Ctrl+F and search for a redacted word. It should not be found.

3. Remove hidden information

A PDF can carry things nobody sees when reading it:

• Metadata: the author’s name, the software used, creation and modification dates. Remove it with the PDF Metadata Remover, which also removes old copies left behind by earlier saves. Our guide to removing your name from a PDF’s metadata explains where it comes from.
• Comments and annotations, each labelled with its author.
• Attachments embedded in the PDF. Look for a paperclip icon or an Attachments panel in your reader.
• Hidden layers, common in PDFs from design and CAD software. Look for a Layers panel.
• Form data filled in earlier, and photos inside the document that keep their own EXIF data, including location.

Flattening the pages to images, as in step 2, removes all of these at once. Acrobat Pro’s Sanitize Document does the same while keeping the text.

4. Watermark it for the recipient

A watermark such as “Confidential: prepared for J. Smith, 3 October 2026” across every page does two things. It reminds the reader that the document is not for passing on, and if a copy turns up where it should not, it shows whose copy it was. Add one with Watermark PDF. A diagonal, tiled watermark at 15–25% opacity is hard to crop out but leaves the text readable.

A watermark discourages leaks and helps trace them. It does not stop a determined person. Anyone with an editing tool can remove a watermark from a PDF that still contains text, and anyone can photograph a screen.

5. Sign it, if a signature is needed

If the recipient needs your signature, add it with Sign PDF after redacting and watermarking, so the signed version is the final one. A drawn or typed signature is an image placed on the page, which is accepted for most everyday agreements. It is not a cryptographic digital signature, which proves the document has not been changed since signing. Contracts that require one need a certificate-based signing service.

6. Encrypt it with a password

A PDF can be encrypted so that it cannot be opened without a password. Two kinds of password are easy to confuse:

• The open password (also called the user password) encrypts the contents. Without it the file cannot be read. This is the one that protects you.
• The permissions password (owner password) only asks programs not to allow printing, copying or editing. Many programs ignore it, so do not rely on it to protect anything.

Use AES-256 encryption with a long password, such as four or five random words. Ways to add one:

• Microsoft Word: File › Save As, choose PDF, click Options, tick Encrypt the document with a password.
• LibreOffice: File › Export as PDF, open the Security tab and click Set Passwords.
• Mac Preview: File › Export, tick Encrypt and enter a password.
• Adobe Acrobat: the Protect tool, Encrypt with Password.
• Command line: with the free qpdf tool:

  qpdf --encrypt "open-password" "owner-password" 256 -- in.pdf protected.pdf

Encrypt last, after every other step. Most tools, including ours, cannot work on a file that is already encrypted.

7. Choose how it travels

• Send the password separately. Use a text message or a phone call, never the same email as the file.
• Prefer a link you can revoke over an attachment. An email attachment lives in inboxes, sent folders and backups indefinitely. A cloud-storage link restricted to the recipient’s account (Google Drive’s Restricted, OneDrive’s Specific people), ideally with an expiry date, can be switched off later.
• Double-check the recipient. Email auto-complete sending the file to the wrong “John” is one of the most common data breaches there is.
• Mind the size. If the file is too large to attach, do not reach for the first free compressor you find. Use one that keeps the file on your device, such as Compress PDF, and read our guide to compressing a PDF without losing searchable text.

The checklist

1. Is this the right file, and only the pages that are needed?
2. Are redactions real? Search for a redacted word: it must not be found.
3. Has the metadata been removed, and are there any comments, attachments or layers?
4. Is it watermarked for this recipient, if it might be forwarded?
5. Is it signed, if a signature is required?
6. Is it encrypted with an open password, with the password sent separately?
7. Is the recipient’s address right, and will a revocable link do instead of an attachment?

Finally, open the exact file you are about to send, as if you were the recipient, and look at it once more. Most mistakes become obvious at that point.

Frequently asked questions

Tools used in this guide