How to send a document securely

What you are actually protecting against

"Secure" is meaningless until you name the threat, and the honest answer for most people is mundane: the file reaching the wrong person. A mistyped address, a reply-all, a forwarded thread, a shared link that outlived its purpose, a laptop left on a train.

Interception on the wire — someone reading your email in transit — is the threat people picture and the least likely one. Mail between major providers is encrypted in transit as a matter of course.

This matters because it changes what to do. Guarding against interception means encryption. Guarding against misdelivery means controlling who can open the file once it arrives, which is a different problem and the one that actually bites.

Why an email attachment is not private

The connection between you and your mail provider is encrypted, and usually so is the hop to the recipient's provider. But the message sits decrypted on both providers' servers, and it stays in both mailboxes indefinitely.

That is the real exposure. A contract emailed in 2019 is still in an inbox, still in a sent folder, still in whatever backup that provider keeps, and still readable by anyone who later gains access to either account. Email is a filing cabinet that copies itself, not a courier.

What actually works, in order

Roughly by effort against benefit:

• Encrypt the file, send the password separately. The single highest-value step. A password-protected PDF is unreadable without the password, so the copies sitting in mailboxes and backups are inert. Send the password by a different channel — a text, a call, anything that is not the same email thread.
• Send less. If the recipient needs one page of a twenty-page record, send that page. Splitting the document is the most reliable privacy control there is, because data you did not send cannot leak.
• Redact properly. Drawing a black rectangle over text in most editors leaves the text underneath, fully selectable by anyone who copies from the file. Real redaction removes the content rather than covering it.
• Strip the metadata. The author name, the producing software, and the creation and modification timestamps travel with the file and appear nowhere on the page. The author field is frequently whoever built the original template.
• Use a link with real restrictions, not a public one. If the file is too large to attach, restrict the share to named recipients and set an expiry. The default on most services is "anyone with the link", which is a URL that will be forwarded.

Where the password goes

Encrypting a file and then emailing the password in the same thread is the most common mistake in this whole area, and it undoes the encryption entirely. Anyone who can read the message can read both parts.

Any second channel is enough — a text message, a phone call, a messaging app, or a password the recipient already knows. It does not need to be sophisticated. It needs to be somewhere the attacker who compromised the mailbox is not.

Choose the password with the same realism. A protected PDF is only as strong as what is guarding it, and the file can be attacked offline at whatever speed the attacker likes. A short or predictable password buys much less than it appears to.

The part that gets forgotten

Almost every guide stops at transmission. But a document is exposed for its whole life, and most of that life happens after it arrives.

If it is genuinely sensitive, agree what happens to it afterwards — deleted when the matter closes, or retained under whatever rule applies. And prefer transfer methods with an expiry, so a link stops working without anyone having to remember to revoke it.

There is one more consideration specific to preparing files for sending. If you compress, redact or convert a document using a web tool, ask where that processing happens. A tool that uploads your file to a server has, by definition, put a copy of it somewhere you do not control — which is a strange first step in a process whose point is limiting copies.

Frequently asked questions