How to send ID copies and documents safely over WhatsApp or email

The safest way to send a document is to send less of it. Before it leaves your phone, cut it down to the pages that were asked for, black out numbers the other person doesn't need, mark it with the purpose and date, and for anything sensitive add a password that you send by a different route. Then delete the stray copies once the job is done.

None of this needs special software. Our Protect PDF tool, for example, adds the password in your browser without uploading the file. Each step takes a minute or two, and together they mean that if the file ends up somewhere it shouldn't, it is far less useful to whoever has it.

First, ask what they actually need

Most oversharing happens before any app is opened. A landlord asks for "ID proof" and gets a full Aadhaar, PAN, and three months of bank statements. A new employer asks for a cancelled cheque and gets the whole passbook scan.

Before you send anything, check three things:

• Which document. If any one ID will do, pick the one that reveals least. A voter ID or driving licence carries less than a full Aadhaar.
• Which pages. A salary slip request usually means the latest month, not the whole year. A bank statement request may only need the page with your name and account number.
• Which details. If they only need to see your name and address, they rarely need a full ID number as well.

For Aadhaar in particular, UIDAI offers a masked e-Aadhaar that shows only the last 4 digits of the number. If the person accepts a masked copy, download that instead of sending the full one. Our KYC document guide covers when masking does and doesn't apply.

A routine that works for most documents

Do these in order. Each one builds on the last.

1. Remove pages that weren't asked for. Drop the extra months, the blank backs of scans and the terms-and-conditions pages with Remove PDF Pages. Our guide on deleting pages from a PDF goes through it.
2. Black out what they don't need. Account numbers, the first 8 digits of an Aadhaar number, a phone number, a home address on a document meant only to prove your name. Our Redact PDF tool rebuilds each marked page as an image with the area filled black, so the hidden text is not left underneath to be copied out.
3. Add a purpose watermark. Text such as "For rent agreement with Mr Sharma, 12 Nov 2026" across an ID copy makes it awkward to reuse for something else. The Add Watermark tool has "For KYC only" as a quick pick. Keep the opacity around 20 to 40% so the details stay readable.
4. Add a password if the document is sensitive. Salary slips, bank statements, medical reports and full ID copies are good candidates. Protect PDF encrypts the file with AES-256, and anyone opening it will need the password.
5. Open the final file yourself. Check that the right pages are there, the black boxes cover what they should, the watermark doesn't hide anything important and the password works.

If you want to go one step further, clear the document's hidden details too. A PDF can carry the author's name, the app that made it and dates. Edit PDF Metadata shows what's there and removes it, and our explainer on what PDF metadata is tells you what to look for.

Choosing and sharing the password

A password only protects the file as well as the password itself does. The encryption is strong; a guessable password is not.

• Use 8 or more characters, ideally a few unrelated words. Your date of birth or "123456" can be guessed by anyone who knows you.
• Never put the password in the same message as the file. If the PDF goes by email, send the password by SMS or tell them on a call. If the file goes on WhatsApp, send the password by a different app or say it aloud.
• Keep your original. If you forget the password, the protected copy cannot be opened and nobody can recover it for you.

You can also block printing or copying with a separate permissions password. Most readers respect those limits, but some software ignores them. Treat them as a polite request, and rely on the open password for real protection.

One catch: many upload portals refuse password-protected files. When you are uploading to a bank's or government department's own website, follow what that site asks for and upload the unprotected copy. Passwords are for files that travel through email and chat.

WhatsApp, email or the official portal?

End-to-end encryption protects a message on its way. It does nothing once the file lands on the other phone, gets saved to its gallery or forwarded to a group. That is why the steps above matter more than the choice of app.

Requests that should make you stop

Be suspicious when someone asks for documents through a channel the organisation wouldn't normally use. Common warning signs:

• A call or SMS saying your KYC will expire today unless you send documents to a personal number.
• A link that asks you to upload ID copies on a site whose address doesn't match the organisation's.
• Someone asking for OTPs, passwords or a photo of your card held next to your face, with no clear reason.

When in doubt, hang up and contact the organisation through the number or website you find yourself, not the one in the message.

After you've sent it

Copies pile up quickly: the original download, the redacted version, the watermarked version, the one in your WhatsApp chat, the one in your email's sent folder. Once the other side confirms they have what they need:

• Delete the working copies from your Downloads folder.
• Delete the file from the chat, especially in groups.
• If you used a shared or office computer, clear the Downloads folder and sign out of email before you leave.

PdfDady's tools run in your browser, so the files you work on are not uploaded to us. The copies you download are still on your device, though, and cleaning those up is on you.

What these steps can't do

Being honest about the limits helps you pick the right step:

• A watermark is a deterrent. Someone with PDF editing software can remove it.
• Redaction here turns marked pages into images. Text on those pages can no longer be selected or searched. Pages without marks keep their text.
• A password protects the file, not the person who opens it. Once they have opened it, they can save or photograph the pages.
• Nothing can pull back a file you've already sent. Deleting it on your side doesn't delete the other person's copy.

Questions people ask

Is it safe to send Aadhaar on WhatsApp?

The transfer itself is encrypted, but the copy stays on the other phone. If you must send it, use a masked Aadhaar where accepted, add a watermark with the purpose and date, and only send it to someone you have verified.

Should I password-protect a PDF before uploading it to a portal?

Usually not. Many portals can't open protected files and will reject them. Passwords are most useful for email and chat.

What password should I use for a protected PDF?

Something long that the other person can't guess and you won't reuse elsewhere, such as three or four random words. Share it by a different channel from the file.

Does sending a PDF instead of a photo make it safer?

Not by itself. A PDF can be redacted, watermarked and password-protected more neatly than a photo, which is why it helps.

Sources

• WhatsApp Help Center: About end-to-end encryption
• UIDAI: What is Masked Aadhaar?