How to Convert a Password-Protected Bank Statement PDF

Banks lock statement PDFs with a password built from your own details. The rules HDFC, ICICI and SBI publish, and how to save or share an unlocked copy.

Many banks lock the statement PDFs they email or let you download. The password is built from details the bank already holds about you, and the rule differs by bank — and sometimes by how you got the file.

Password rules, as the banks state them

Each rule below is taken from the bank's own help pages, checked in October 2026, and split by how you got the statement where the bank splits it. Banks whose rule we could not find on their own site are left out rather than guessed — SBI's regular monthly e-statements, Axis Bank's account statements and Kotak among them. For those, the covering email or the download page states the rule.

Bank	How you got the statement	Password
HDFC Bank	Downloaded from NetBanking or the HDFC Bank app	Your Customer ID: the numeric ID you log in to NetBanking with
ICICI Bank	Emailed account statement	Eight characters: the first four letters of the account title in lowercase, then your day and month of birth as DDMM (for a current account, the date of incorporation). No spaces or salutations. An account titled SAMPLE NAME, born on 5 January, opens with samp0501
ICICI Bank	Emailed account statement, the alternative	The 12-digit account number. The email's subject line shows its last two digits
SBI	e-statement requested by SMS (ESTMT) through SBI Quick	The four-digit code you chose and sent in that SMS

Two ways to handle it

Supply the password to the converter

The simpler route: upload the locked file and enter the password. The PDF is unlocked in memory for the conversion. A well-built service never writes the password to disk and never stores it.

Or save an unlocked copy first

Open the PDF with its password and save a copy that has none. How to do that, and what to do with the copy afterwards, is the next section.

Saving or sharing a statement without the password

Sometimes the password is the obstacle rather than the conversion: your accountant needs the statement, a lender's portal refuses locked files, or you will open it every week. You can make an unlocked copy yourself, from the file you already have, with the reader already on your computer — nothing uploaded, and no tool that claims to remove passwords.

Open it with the password In any PDF reader: Edge, Chrome, Adobe Acrobat Reader, or Preview on a Mac.
On Windows or in a browser: Print, then Save as PDF Choose Print, pick Microsoft Print to PDF as the printer (in Chrome or Edge, Save as PDF), and save under a new name. The copy opens without a password.
On a Mac: Preview, File, Export as PDF Save the copy under a new name. If it still asks for a password, use File, Print, then PDF, Save as PDF instead.
Check the copy before you rely on it It should open without asking, and you should be able to select a word of text. If the text will not select, the reader turned the pages into pictures — keep the locked original for converting, and supply its password instead.

What to check before uploading anywhere

Is the connection HTTPS?
Is there a stated deletion policy, with a specific timeframe?
Is it clear the password isn't retained?
Is there a privacy policy that says data isn't sold or shared?

Why banks lock statements at all

The password is not really protecting the document from a determined attacker — it is protecting you from the most common accident, which is a statement sitting unencrypted in an email inbox that later gets compromised. Because the password is derived from details you already know, it costs you nothing while making a leaked mailbox much less immediately useful.

That is also why the passwords are formulaic. They are a speed bump by design, not a vault.

If the password does not work

Check the case. The field is case-sensitive, and banks differ: ICICI's rule for account statements is lowercase, while Axis Bank's for credit card statements is capitals.
Check the date. Day then month, with or without a year, and a year of two digits or four. The rule says which — ICICI's, for example, is DDMM with no year.
Check which name. For a joint account it is normally the first holder's details, not whoever received the email. ICICI says so explicitly.
Check how the statement reached you. The rule can depend on it: an SBI e-statement requested by SMS opens with the four-digit code you chose, not with anything the bank holds about you.
Re-read the covering email. The rule is nearly always stated there, and it beats guessing.

After conversion

One point worth making: the converted Excel or CSV file is not password-protected. You have just turned a locked document into an open one containing the same sensitive data. Store it accordingly, and delete it when you are finished — particularly if it is a client's statement rather than your own.

Frequently asked questions

Is the password stored anywhere?

No. It's used to open the document for the conversion and then discarded with the rest of the request.

Does removing the password change the data?

No. Unlocking a PDF does not alter its contents. What can alter them is printing to PDF in a reader that rasterises the page, which turns text into an image.

Is my converted file protected too?

No — the Excel and CSV exports are ordinary unprotected files. Store and dispose of them with the same care as the original statement.

What if I've forgotten the password?

Your bank can re-issue the statement. There is no legitimate way to recover a password you don't know, and tools that claim otherwise are best avoided.

Convert a statement now

Bank Statement PDF to Excel, or see every format. More in the guides.