Converting a Password-Protected Bank Statement PDF
By Tarun Vashishth · Published
Many banks encrypt downloaded statement PDFs with a password by default — often your account number, SSN last four, or a code the bank assigns, depending on the institution. That password protects the file at rest, but it also means any converter needs it to read the statement at all.
How PDF password protection actually works
A password-protected PDF is encrypted — the text and structure inside are unreadable without decrypting it first, which requires the password. This is different from a PDF that's merely locked against editing; a genuinely password-protected statement can't be parsed, converted, or even have its text selected without supplying the correct password to decrypt it.
What happens when you drop one into this tool
The PDF is loaded locally using pdf.js. If it's encrypted, the library reports that a password is needed before it can proceed, and you're prompted for one directly in the tab. That password is passed to pdf.js entirely inside your browser to decrypt the file locally — it's never transmitted anywhere, because nothing on this site can transmit anything: the sameconnect-src 'none'Content-Security-Policy covered on the privacy page applies here too. If the password is wrong, you get told plainly and can try again — earlier versions of this tool failed silently on a wrong password, which was fixed specifically because a silent failure on a password field is easy to mistake for the tool being broken rather than the password being incorrect.
Where to find your statement's password, if you don't know it
Most banks document their default PDF password scheme on their statement download page or in help articles — commonly some combination of account number, SSN, ITIN, or date of birth digits, varying by institution. Check your bank's own help center rather than guessing; the scheme differs enough between banks that there's no universal default to try.
What this doesn't cover
Password protection is separate from the statement being a scanned image versus native text — a password-protected statement can be either. Once decrypted, the same rule applies as any other statement: if it has a text layer, it parses normally; if it's a scan with no embedded text, decrypting it doesn't change that there's nothing for a text-based parser to read. Seewhat's actually inside a bank statement PDF for that distinction.
Related: how privacy is enforced, including for the password,the full parsing pipeline.