How to Share PDFs Securely: Passwords, Redaction, and Link Expiry

Key takeaways

• PDF password protection encrypts the file itself, but a password shared over email is only as secure as the email channel.
• Redaction must be permanent — covering text with a black box does not remove the underlying text unless the redaction is properly flattened.
• Link-based sharing gives you revocation control that an emailed file attachment never provides.
• For sensitive documents, encrypt the file before attaching it and share the password through a separate channel.

Sending a PDF as an email attachment is the default for most document workflows. It is also one of the least controllable ways to share a file: once it leaves your outbox, you cannot revoke access, update the content, see whether it was opened, or stop the recipient from forwarding it. Depending on what is in the document, that may be fine — or it may not be.

Here is what the main options actually provide, and where they fall short.

Password-protecting a PDF

A PDF password encrypts the file. Without the password, the file is unreadable — not just locked from editing, but genuinely unreadable to anyone who intercepts it or accesses it from the wrong device.

What this does well: protecting a file at rest. If the PDF ends up somewhere it should not — backed up to an untrusted cloud service, captured in transit, stored on a lost device — the encryption makes it useless without the password.

What it does not solve: the password distribution problem. If you email the PDF and then email the password in a follow-up message, both are in the same email thread, in the same inbox, on the same server. An attacker who has access to one has access to both. For meaningful security, the password should travel through a different channel — a phone call, a separate messaging app, a physical note — than the file itself.

Setting a strong PDF password: Use a phrase of 4–5 random words rather than a short mixed-character password. It is easier to communicate verbally and far harder to brute-force.

In PDFPilot, password protection is under Security → Set Password — you set the open password and optionally a separate permissions password that restricts printing or editing.

Redaction: what actually works

The most common redaction mistake is drawing a black rectangle over sensitive text using a PDF editor’s annotation tools. This adds a black box as a visual layer on top of the original text — the text is still there underneath. Anyone who copies the document text, removes the annotations layer, or opens the file in a tool that renders annotations differently can read what you covered.

True redaction removes the underlying text or image data, not just obscures it visually. In Stirling PDF (what PDFPilot routes you to), this is a dedicated redaction operation that burns the removal into the document — the text is replaced with blank space at the content layer, not covered at the annotation layer.

Before sharing any redacted document, verify your work: open the finished file in a plain PDF reader, select all, copy, paste into a text editor. If the redacted content appears in the pasted text, the redaction was not applied correctly.

Link-based sharing vs. file attachments

Sharing via a link (Google Drive, Dropbox, OneDrive, a secure document portal) gives you capabilities that a file attachment cannot:

Revocation. You can make a shared link stop working at any time. An emailed file attachment is permanent — once the recipient has it, they have it.

Version control. Update the document and the link automatically serves the latest version. Every copy of an emailed attachment is a frozen snapshot that persists indefinitely.

Access logging. Most platforms show you whether the link was opened, when, and from which account (if the recipient is signed in). An email attachment gives you none of this.

Expiration. Most platforms let you set a link to expire after a date or number of opens. An attachment has no expiration.

The tradeoff: link-based sharing requires the recipient to have (or create) an account on the platform, or rely on anonymous link access. For external parties, anonymous link access is often more practical but gives up the logging benefit.

When to combine both

For documents that are both sensitive in transit and sensitive at rest — a signed contract, a financial statement, a legal document — the most practical combination is:

1. Redact properly any content that should not appear in the shared version.
2. Share via a link with revocation and an expiration date, rather than as an email attachment.
3. Restrict to specific accounts if the platform supports it, rather than a public link.
4. Password-protect the file as well if it may be downloaded and stored outside the platform.

This layers the controls: link revocation handles the access problem, expiration handles the time problem, and file-level encryption handles the “stored outside your control” problem.

What not to do

Do not mark content as “confidential” in the header and call it done. A label is not access control.

Do not use annotation-layer redaction. Cover text visually if you need a visual placeholder, but remove the underlying data with a proper redaction tool.

Do not share the file and the password in the same message. They defeat each other’s purpose.

Do not assume the recipient’s email account is as secure as yours. A document shared with one person via email has been effectively shared with everyone who can access their inbox — which includes, at minimum, their IT department, their email provider, and anyone who has ever had access to their account.

For most everyday documents, the risk is low enough that none of this matters. For documents that actually contain something worth protecting, these steps cost almost nothing and matter a great deal.