Someone needs a copy of your passport, your lease, a bank statement, a signed form — and the request ends with "just email it over." Before you attach anything, know this: a plain email is a postcard. It's copied across several servers on the way, then sits in your Sent folder and the recipient's inbox for as long as either of you keeps an account.

The safe way takes a few extra minutes. Send the document as a password-protected PDF, send the password by a different channel (a text or a phone call), redact whatever the recipient doesn't need before you protect it, and delete the sent copy once it has done its job. The rest of this page walks through each step on iPhone and Mac, using free tools that never upload your file.

Why email is the wrong default for a passport scan

Email wasn't built for secrets. It was built for getting a message from one computer to another through whatever machines sat in between — which is why it's still everywhere, and why it's a poor fit for a photo of your passport. Here's what happens to an attachment after you hit send:

  • It's copied, not moved. Your mail provider keeps a copy. The recipient's provider keeps a copy. Every device with the mail app downloads its own.
  • It never expires. The file sits in your Sent folder and in their inbox until someone deliberately deletes it. Years later, if either account is broken into, the scan is still right there, searchable by the word "passport."
  • It's one tap from being forwarded. A leasing agent forwards it to the property manager, who forwards it to the owner, who has an assistant. Nobody meant any harm, and now there are six copies in inboxes you've never heard of — exactly the kind of inbox criminals go looking for.

The encryption between mail servers that most providers use today helps against someone listening in on the wire. It does nothing about the copies sitting on both ends, which is where the real risk lives. So the file itself has to carry its own protection — then every stray copy is just noise to anyone without the password.

The five-step safe method

This is the whole method; the sections below expand on each step.

  1. Scan cleanly. Use a real scanner — the one built into the Notes app on iPhone, or a scanner app you trust — rather than a quick photo, so you get a flat, cropped, readable PDF. (Not sure which scanner apps respect your privacy? Here's how to judge one.)
  2. Redact what isn't needed. Ask the recipient which fields they actually need, and permanently black out the rest — properly, not with a see-through highlighter.
  3. Password-protect the PDF. Modern PDF encryption (AES-256) is the same standard used for online banking; the weak point is always the password, so pick a short phrase of unrelated words rather than a pet's name.
  4. Email the file; send the password another way. Attach the protected PDF and send it. Then text the password, or say it over the phone. Never put it in the same email — and not in a follow-up email either. Same inbox, same problem.
  5. Delete the sent copy, and ask them to delete theirs. Once they confirm they have what they need, delete the message from Sent and from Trash. A one-line "please delete this once you've filed it" is a normal request, and most professionals will honor it.

The order matters: redact before you encrypt (you can't edit a locked file), and encrypt before you attach (the attachment is what gets copied everywhere).

How to password-protect a PDF before emailing (Mac, iPhone, no Adobe)

You don't need a paid PDF editor for this. Two free ways:

On a Mac, with Preview. The app that opens PDFs by default can encrypt one in a few clicks:

  1. Open the PDF in Preview.
  2. Choose File → Export.
  3. Click Permissions (on older versions of macOS, tick the Encrypt box instead).
  4. Turn on Require Password To Open Document, type the password twice, and click Apply, then Save.

Give the exported file a new name, open it once to check that it asks for the password, then attach that one.

On an iPhone, or any device, in the browser. Files and Photos have no "add a password" button, and the usual advice — upload your passport scan to some random "protect PDF" website — is a contradiction: you'd be handing the document you're trying to protect, plus its password, to a stranger's server.

Our free protect-PDF tool does the job entirely in your browser instead. Open it in Safari on your iPhone or on any computer, choose the PDF, set a password, and save the encrypted copy. The encryption runs on your device; the file and the password never leave it. It also checks its own work — reopening the output with your password to confirm it unlocks, and without it to confirm it refuses — and shows a plain-English strength meter as you type.

Either way, the result is a standard encrypted PDF: Preview, Chrome, mail apps, and iPhones all prompt for the password and open it normally, so the recipient needs nothing special.

Picking the password. Length beats cleverness. Four unrelated words ("copper-lantern-tuesday-fox") are far stronger than "P@ssw0rd1" and easier to read out over the phone. Don't reuse it from anything else, and write it down — there is no "forgot password" for an encrypted file, which is exactly what makes the protection real.

Redact first — and why black boxes in screenshots aren't redaction

Most requests need far less than the whole document. A landlord verifying identity needs your name, photo, and expiration date — usually not the document number or the barcode. Ask "which fields do you actually need?" and remove the rest.

Here's the trap: drawing a black box over text in most apps doesn't remove the text. It adds a rectangle on top of it. In a PDF, anyone can select the text under the box and paste it out, or simply delete the rectangle. A see-through "redaction" is worse than none, because it looks safe.

Two ways to redact for real:

  • For a PDF: use our redact-PDF tool. Draw a box over anything sensitive, or type the name or number you want gone and mark every occurrence at once. The output is rebuilt page by page as flat images with the boxes burned in — there is no text left under them to copy. It runs in your browser, so the file stays on your device.
  • For a single image on iPhone: open it, tap Markup, cover the field with a solid black shape at full opacity (never the highlighter), then take a screenshot of the result and send the screenshot, not the edited original. A screenshot is flat pixels; there's no layer underneath to peel back. Our guide to sharing documents from your iPhone walks through it.

Then, and only then, password-protect the redacted file.

Ways to send a document, compared

"Secure" means three different things: protected while the file is moving, protected while it sits on someone's computer, and whether you can ever take it back.

How you send it Protects in transit? Protects at rest? You control deletion? Good for
Plain email attachment Usually, between mail servers No — readable in every inbox it lands in No Low-stakes paperwork: a receipt, a signed permission slip
Password-protected PDF by email Yes Yes — unreadable without the password No, but stray copies are useless without the password IDs, statements, contracts, when email is the only channel they accept
Encrypted email service Yes Yes, if both sides use it Partly — some let you expire messages People you write to regularly who are set up for it
Secure upload portal the recipient provides Yes Yes — lands in their system, not an inbox No, but nothing sits in an inbox Lenders, government offices, HR, clinics
iCloud or Drive link with an expiry Yes Depends on the link settings Yes — turn the link off anytime Files a few people need for a limited time
Messaging app with end-to-end encryption Yes On both phones, as a regular message Partly — disappearing messages, if both sides use them Quick sends between people who trust each other's phones
Fax, or handing it over in person Fax: no; in person: yes Depends on what they do with it No Offices that require it; originals that must be seen

Three rows deserve a note:

"How do I send an encrypted email?" What people mean is end-to-end encryption — only the sender and recipient can read the message — and that needs both sides to use a service that supports it. Fine for an accountant you write to every month; for a one-off send to a landlord, the password-protected PDF gets you the same practical outcome with nothing for them to install.

Links with an expiry. Sharing a PDF from iCloud Drive or Google Drive, then turning the link off next month, is the grown-up option when several people need a contract for a limited time — you keep the file; they view it. (Mail Drop on a Mac does something similar for huge attachments, with a link that expires after 30 days.) A link is a convenience, not a substitute for a password — anyone who gets the link gets the file.

The portal. If the recipient has a secure upload page — most lenders, government offices, and HR departments do — use it, even if emailing would be faster. It exists precisely so your documents don't live in someone's inbox. When you're applying for a mortgage, the portal is where pay stubs and statements should go; the email thread is for questions.

What not to send by email at all

Some things are too dangerous to email even with a password, because one guessed password or one careless recipient hands over a complete identity:

  • Your full national ID or Social Security number, date of birth, and a photo ID together. Each alone is a problem; together they're an identity kit. If a form genuinely needs all three, that's what portals and in-person visits are for.
  • Bank login details, card PINs, or one-time codes. No legitimate business asks for these by email, ever. A request that does is a scam, not paperwork.
  • Anything the recipient hasn't asked for. "I'll just send everything so they have it" multiplies the copies in circulation. Send what was requested, nothing more.
  • Someone else's documents without their say-so. Your spouse's passport, your kid's medical record — if it's not yours, ask first.

When the other side insists on email

Landlords, HR coordinators, and loan officers ask for email because it's easy for them, not because it's safe for you. Most will go along with a small change if you ask plainly:

"Happy to send that over. I'll attach it as a password-protected PDF and text you the password — is this the right number? Once you've filed it, could you delete the email?"

You're not accusing anyone of anything; you're describing what you're about to do. The usual response is "sure" — and if they have a portal they forgot to mention, this is when they remember it.

If they push back — "our system only takes plain attachments" — you still have options:

  • Send the protected PDF anyway. Every PDF reader opens it once they type the password. "Our system" almost always means a person's inbox.
  • Send less. Redact down to the exact fields they need, so even an unprotected attachment reveals the minimum.
  • Ask for their secure channel. "Where do you normally have clients upload ID?" often turns up an upload page the person you're talking to doesn't use day to day.
  • Split the risk. Email the redacted document and read the missing detail — the document number, say — over the phone.

The scenario guide on renting an apartment covers which documents a landlord can reasonably ask for, so you can tell a normal request from an excessive one.

After sending: where your own copy should live

The errand's done. Now look at the trail it left on your phone: a photo of your passport in the camera roll, "Scan 14.pdf" in Files, an unprotected copy in Downloads, the email in Sent. Each is a loose copy of your identity, visible to anyone you hand your unlocked phone and to every app with photo access.

  1. Delete the sent email from Sent and then from Trash.
  2. Delete the unprotected working copies — the original scan and any redacted version — from Files, Downloads, and Photos (then Recently Deleted).
  3. Keep one master copy somewhere locked. You'll be asked for this document again; don't rescan it every time. A locked home means a place that asks for Face ID, keeps the file encrypted, and doesn't show your passport in a grid of lunch photos — here's why that matters.

That last job is what Paperlock is for. Save the passport or lease once and it lives encrypted on your phone behind Face ID, with sensitive documents showing blurred thumbnails until you confirm it's you. The next time a lender asks, export it as a PDF on the spot, redact and protect it, and send — no hunting through Photos, no stray copies left behind (how it works). That master copy is also the one worth backing up properly.

Do the five steps once and they take three minutes. Do them every time and a stolen inbox — yours or theirs — stops being the end of the world.