How to send a PDF securely by email
Email was designed to copy things. Every attachment you send creates a file on someone else's machine that you have no further contact with — no expiry, no recall, no record of where it goes next. That is not a flaw anyone is going to fix; it is what email is.
So "sending a PDF securely by email" splits into two different problems, and most advice online conflates them. One is stopping the wrong person reading it in transit. The other is controlling what the right person does with it afterwards. Different tools solve each, and the second is the one that usually matters commercially.
Problem one: the wrong person gets it
Password on the attachment
Encrypting the PDF with an open password is genuinely effective against a misdirected email or an intercepted message — provided you send the password some other way. Texting the password is fine. Putting it in the same email, or in a follow-up email, defeats the entire exercise, and it is what most people do.
Your mail provider's encryption
Outlook message encryption and its equivalents protect the message in transit and force the recipient to authenticate. Solid for compliance-driven internal mail. Two caveats: it usually works best when both sides are in the same ecosystem, and once the recipient has opened and saved the attachment, the protection ends.
Gmail confidential mode
Confidential mode removes forward, copy, print and download from Gmail's interface and can set an expiry and an SMS passcode. Useful and free. It is strongest when the recipient also reads in Gmail, and like everything else it cannot stop a photograph of the screen. A reasonable deterrent; not document control.
Problem two: the right person forwards it
This is where most real leaks happen, and none of the above touches it. The person you deliberately sent the document to opens it, likes it, and sends it to a colleague — or a study group, or a competitor. They are not an attacker. They are a recipient behaving normally with a file that behaves like a file.
Cloud drive links
Sharing a link rather than an attachment is a real improvement, because a link can be revoked. The catch is that most drive links protect the container rather than the content: once viewing is permitted, downloading usually is too, and "anyone with the link" quietly removes the control you thought you had. Check whether download is off by default, and whether the link is scoped to named people.
Controlled access instead of a file
The alternative is to send a link to a controlled copy, where the rules are evaluated at every open rather than baked into a file at send time. In practice that means:
- The recipient's name is on every page they read, so a forwarded screenshot names its source.
- Access ends on a date you set, or when you revoke it — on documents already delivered.
- Printing and copying are allowed or blocked by policy, not by a flag the reader can ignore.
- You can limit how many devices one reader uses, and see what was opened and when.
The trade is that the recipient reads in a browser rather than double-clicking an attachment. For a colleague that is a small imposition. For a paying customer, a member or an exam candidate it is normal, and it is the only way the document stays under your policy after it arrives.
A practical rule of thumb
- Routine internal document? Attach it. Not everything needs protecting, and over-controlling ordinary work costs you goodwill.
- Sensitive but low-value-to-others — an invoice, an HR letter? Password the attachment, send the password by text.
- Regulated or client-confidential? Use your provider's message encryption so the transport and authentication are auditable.
- Anything with commercial value to a third party — priced reports, courseware, standards, exam material? Send controlled access. The people who redistribute it are the people you meant to send it to.
What none of this fixes
A person can photograph a screen. That is true of every method on this page, including ours, and anyone telling you otherwise is selling something. What changes is whether redistribution is effortless and anonymous or deliberate and attributable. Recipient watermarking does not prevent the photograph; it puts a name on it. For most organisations that shift is the entire point, because it moves the problem from "we will never know" to "we will know exactly who".
Our security overview is explicit about where the limits are.
Where MyPass DRM fits
MyPass DRM sends controlled access rather than attachments. Recipients open the document in a browser with no install, the policy is checked at every open, and each open is recorded. Access can be shortened or revoked after delivery, and the same operations are available through a public REST API when the sending happens inside your own platform. There is a free tier covering up to 100 active documents a month if you want to test it against a real document before deciding.
Common questions
Do not attach the file. Send a link to a controlled copy that the recipient opens in their browser, with the rules — who may open it, for how long, whether it can be printed — checked at the moment they open it. An attachment is a copy you no longer control; a controlled link is a copy you still do.
It depends what you are protecting against. It is reasonable against the wrong person receiving a misdirected email, provided you send the password by another channel. It does nothing against the intended recipient forwarding the file, because they have the password and can save an unlocked copy the moment they open it.
Partly. It removes the forward, copy, print and download options in Gmail's own interface and can expire the message. It does not stop a recipient photographing the screen, and its protection is strongest when the recipient is also reading in Gmail. Treat it as a useful deterrent inside one mail ecosystem rather than as document control.
Not with a plain attachment. Once a file lands in an inbox, nothing reports back. If you send a controlled link instead, each open is recorded with the reader and the time, which is also how you find out a document is circulating further than you intended.
You cannot recall an attachment — the copy is already on their machine. You can revoke access to a controlled link, and it stops working for that reader including on a document already delivered. This is the single practical difference between sending a file and sending access.