Contracts, medical records, tax forms, HR letters, plenty of PDFs contain information that would cause real harm in the wrong hands. Sharing them safely is about more than clicking "attach." This guide covers the practices that actually protect a document in transit and at rest, and the common mistakes (like fake redaction) that quietly leak data.
1. Encrypt before you send
A Document Open password with AES-256 encryption means that even if the file is intercepted or forwarded, the content stays unreadable without the password. Add one using the steps in how to password-protect a PDF, and choose a passphrase of at least 12 mixed characters. See how PDF encryption works for why the algorithm matters.
2. Send the password out of band
Never put the password in the same email as the file, if that inbox is compromised, both are lost together. Send the file by email and the password by text message, phone call, or a separate secure app. This "out of band" delivery is a small habit with a large payoff.
3. Prefer expiring links for the most sensitive files
Email attachments live forever in mailboxes and backups. For highly sensitive documents, a secure sharing service that offers link expiry, download limits, and access logging gives you control you can't get with an attachment, you can revoke access after the recipient has downloaded it.
4. Redact properly: black boxes are not redaction
This is the mistake that has embarrassed governments and law firms alike. Drawing a black rectangle over a name or number only covers it visually. The text is still in the file: select-all and copy, or run text extraction, and it reappears. The same is true of "highlighting" in black.
Real redaction permanently deletes the underlying content:
- Acrobat Pro: Tools → Redact → mark the content → Apply. Applying is what actually removes it. Then use "Sanitize Document" to strip hidden metadata.
- Always verify afterwards by trying to copy the "redacted" area.
5. Strip hidden metadata
PDFs carry metadata, author name, software, revision history, sometimes earlier edits. Before sending externally, remove it (Acrobat's "Sanitize Document," or an export that resets metadata). It's an easy leak to overlook.
A quick pre-send checklist
- Encrypted with a strong open password?
- Password sent through a different channel?
- Redactions applied, not just drawn, and verified?
- Metadata sanitised?
- For the most sensitive files, an expiring link instead of an attachment?