How to open a password-protected bank statement PDF

If you have ever opened a statement emailed by your bank and been met with a password box, the file is encrypted. Banks do this because a statement contains your account number, your address and every transaction you made — plenty for someone to impersonate you. The password is almost never sent in the same email, which is the point.

Where the password comes from

Banks do not generate a random password. They derive it from information only you and the bank already share, so it can be described in the email rather than sent. The recipe differs by bank and sometimes by product, but it is usually built from some combination of:

• your date of birth, usually as DDMMYYYY or DDMMYY
• the first few letters of your name, often in capitals
• your customer ID, or the last four digits of the account or card number
• your PAN, in whole or in part

The exact format is stated in the email that carried the statement, usually directly under the attachment or in small print at the bottom. That email is the authoritative source — formats change, and they differ between a savings account statement and a credit card statement from the same bank.

If the password is refused

Before assuming the file is broken, check these, roughly in order of how often they turn out to be the problem:

• Case matters. If the format uses letters from your name, they are usually uppercase. DEVI and devi are different passwords.
• No spaces. A name fragment joined to a date has nothing between the two parts.
• Check the year format. Four digits and two digits are both common, and trying the other one solves this more often than anything else on this list.
• Use the name the bank holds. Not a shortened version, and not one with a middle name if the bank does not have it.
• Copy-paste can carry a trailing space. Type it by hand once before concluding it is wrong.

If none of that works, download the attachment again. A statement that was interrupted mid-download will refuse every password, because the file itself is incomplete rather than locked.

Do you need to remove the password?

Usually not, and removing it is worth thinking about before you do it. An unlocked statement sitting in your downloads folder is a plain-text record of your finances. The encryption is doing something useful.

Tools that offer to “unlock your PDF online” ask you to upload a complete financial record to an unknown server in order to hand you back a file with its protection stripped off. That is a poor trade. If you do want a decrypted copy, do it locally — most desktop PDF readers can save an unprotected duplicate once you have opened the file with the correct password.

Analyzing a locked statement directly

You can skip the unlocking step. ScanStatements accepts an encrypted PDF and the password together, opens the file in memory to read the transactions, and never stores the password. What is kept is the extracted transaction data and the original file — the original stays exactly as your bank encrypted it.

1. Sign in with Google — there is no separate password to create.
2. Choose the statement PDF, up to 20 MB.
3. Enter the PDF password in the field below the file.
4. The transactions are extracted and categorised — dining, grocery, transfer, utilities, travel, healthcare, rent, loan and others — with merchants and repeat charges grouped for you.

See what the analysis looks like on sample data first, without an account, or upload your own statement.

A note on what you upload

Whatever service you use, it is worth knowing what happens to the file. Your statement is processed to extract transactions, the password is used only to open it and is not retained, and the analysis is visible only to your signed-in account. If a service cannot tell you plainly what it keeps, that is reason enough to pick a different one.