You download a statement, open it, and are asked for a password nobody gave you. This is normal, most Indian banks and many European ones encrypt statement PDFs by default, and the email announcing the statement often does not say what the password is.
Why banks do it
Because the statement usually arrives by email, and email is not a secure channel. It sits on your mail provider's servers, on the bank's, and on any backup either keeps. Encrypting the attachment means an intercepted or misdelivered message is not a complete disclosure of your finances.
The password is generally something you know and an attacker probably does not, your PAN, your date of birth, your customer ID, which is weak protection against a determined attacker and reasonable protection against the far likelier case of the email going to the wrong address.
What the password usually is
These are the conventions the major banks use. They change them occasionally and vary by product, so treat this as the list to try rather than a guarantee.
| Bank | Usual format |
|---|---|
| HDFC Bank | First 4 letters of your name in caps + date of birth as DDMM |
| ICICI Bank | First 4 letters of your name in caps + date of birth as DDMM |
| State Bank of India | Date of birth as DDMMYY, or your account number |
| Axis Bank | Customer ID, or date of birth as DDMMYYYY |
| Kotak Mahindra | Customer relationship number, or date of birth as DDMMYYYY |
| Many UK and EU banks | Date of birth as DDMMYYYY, or the last digits of your account number |
Case matters. A password of ABCD1503 is not the same as abcd1503, and this is the single most common reason a correct-looking password is rejected. Check the email again too, the format is often in the body, in small type, below the attachment.
If none of them work, your bank's app or net banking will let you download a fresh copy, sometimes with the option to set your own password or to skip encryption entirely. That is faster than guessing.
Do not upload it to a "PDF password remover"
This is the part worth being firm about. Search for how to open one of these files and you will find dozens of sites offering to remove the password if you upload the PDF and type in the password.
Think about what that asks of you: send a stranger your complete bank statement and the credential protecting it. The encryption existed precisely to stop that file being readable by anyone who happened to get hold of it, and you have just handed over both halves.
Even assuming complete good faith, and most of these services are legitimate, the file now sits on a server, possibly in a log, possibly in a backup that outlives the deletion promise. See what is actually in a bank statement for why that is worth more care than it usually gets.
Opening it without uploading anything
You do not need to remove the password to work with the file. Both of these keep it on your machine:
To read it: open it in any PDF reader and type the password. That is what it is for.
To convert it to a spreadsheet: the statement converter here accepts the password directly. It runs in your browser, so the file and the password both stay on your device, nothing is transmitted, and you can confirm that by watching your browser's Network tab or by going offline after the page loads.
The converter then does the thing that matters: it checks every row's running balance against the row above it, so you can see the extraction is correct rather than hoping. More on why that check exists in why converters get it wrong.
If you genuinely need an unencrypted copy
Sometimes an accountant's portal or a lender's upload form will not accept an encrypted PDF. The safest route is your bank: most net banking systems will issue a statement without a password, or let you set one you choose.
Failing that, open the file with the password in a desktop PDF reader and print it back to PDF. That produces an unencrypted copy locally, without sending anything anywhere. Be aware that on some readers this rasterises the text, check you can still select a sentence afterwards, or the file becomes useless for conversion.