A password-protected bank statement PDF comes in two kinds, and only one of them needs a password. A file that asks for one when you open it cannot be converted until someone types it. A file that opens with no prompt can still be encrypted, and a converter may refuse it as locked. Evidilo reads some of the second kind and refuses the rest, and a copy written without encryption converts either way.
Encrypted is not the same as password-protected
A PDF has room for two passwords. The open password, which the PDF standard calls the user password, is the one a viewer asks for. The owner password guards the permissions: whether text can be copied out, whether the file can be printed or edited. The qpdf manual puts it plainly: “A PDF file can be encrypted without being password-protected.” That is done “by using the empty string as the user password and some secret string as the owner password.”
So a statement that opens in a browser with no prompt, but will not let you select a row and copy it, is encrypted all the same. The viewer opens it with the empty password and then obeys the restrictions. A converter has to do the same thing to read it, and whether it can depends on which encryption the bank’s software chose.
Eight versions of one statement
On 26 October 2026 we wrote one synthetic statement page eight ways with pikepdf 10.17.0, which is built on qpdf 12.4.2. Five copies carry encryption with an empty open password and copying turned off; two carry an open password. Each went through the check Evidilo’s upload runs on every PDF and through its reader, and was opened with pdf.js 6.4.299. The pdf.js README says “PDF.js is built into version 19+ of Firefox.”
| Encryption | pdf.js opens it with no password | Evidilo’s upload | After writing it back without encryption |
|---|---|---|---|
| None | Yes | Accepted, text read | Not encrypted |
| RC4 40-bit (R2), no open password | Yes | Accepted, text read | Accepted, text read |
| RC4 128-bit (R3), no open password | Yes | Accepted, text read | Accepted, text read |
| RC4 128-bit through a crypt filter (R4), no open password | Yes | Refused as locked | Accepted, text read |
| AES 128-bit (R4), no open password | Yes | Refused as locked | Accepted, text read |
| AES 256-bit (R6), no open password | Yes | Refused as locked | Accepted, text read |
| RC4 128-bit (R3) with an open password | No, asks for it | Refused as locked | Accepted once the password was given |
| AES 256-bit (R6) with an open password | No, asks for it | Refused as locked | Accepted once the password was given |
Three of the five files a viewer opened without a word were refused by Evidilo with “This PDF is locked with a password.” Its reader opens the RC4 encryption written as R2 and R3 with the empty password, and declines R4 and later rather than read half of a file. The refusal comes before the file is stored and before the upload is counted against the day’s free statements. Every one of the seven encrypted files was read once it had been written back without encryption.
The page was synthetic, so this says nothing about which encryption a given bank uses. It does say that “it opens fine on my screen” does not settle whether a converter can read it.
How to tell which kind you have
Open the file. A viewer that asks for a password before it shows anything means an open password, and you need it from whoever has it: the account holder, or the bank’s own instructions for its statement passwords. A file that opens straight away but refuses to let you copy a line, or that a converter calls locked, has an empty open password and restrictions on top.
For the exact handler, qpdf’s --show-encryption option prints it; the qpdf command-line reference describes it as: “This option shows document encryption parameters.” The R number and the cipher it prints line up with the first column of the table above.
Getting a copy a converter can read
- Where the bank offers the same months as a CSV or Web Connect download, take that instead: it carries no encryption to remove, and a bank statement as CSV or Excel covers which of those to take.
- If the PDF is all there is, write a copy without encryption. qpdf’s
--decryptdoes this, which its manual describes as “Create an output file with no encryption even if the input file is encrypted.” Add--password=and the password for a file that asks for one. In our test Evidilo read the opening balance off every copy written this way. - Do it only on statements you are entitled to work with. The same manual says the option “is not intended to be used for bypassing copyright restrictions or other restrictions placed on files by their producers.” A client’s own statement prepared for their own books is the ordinary case; a file someone locked to keep you out of it is not.
- Upload the copy, then check the totals. A file that converts is not yet a file that adds up, and what a tied-out statement tells you covers what the balance check does and does not prove.
What Evidilo is
Evidilo is a bank statement to accounting import file converter, and its upload names a locked PDF as locked instead of returning an empty file. It turns a PDF, a scan, a photo of a paper statement, a CSV, an Excel file, a Word document or an OFX/QFX file into QBO, IIF, OFX, QFX, QIF, CSV or Excel, and adds up every row against the opening, closing and daily balances the bank printed. Three statements a day convert free, up to 10 pages each, without an account.
How was this checked?
On 26 October 2026 we wrote one synthetic statement page as eight PDFs with pikepdf 10.17.0, put each through Evidilo’s production upload check and reader through vitest, and opened each with pdf.js 6.4.299 with no password. No real bank statement was used, and the qpdf command-line tool itself was not run: the decrypted copies were written by pikepdf, which uses the same qpdf library. The results are in dataset.csv, and check.py rebuilds the eight files, repeats every reading and re-reads the qpdf and pdf.js pages.
Questions about locked statement PDFs
Why does my converter say the bank statement PDF is locked when it opens without a password?
Because the file is encrypted with an empty open password, and the converter cannot open that kind of encryption. Evidilo read the RC4 R2 and R3 kinds in our test and refused the R4 and AES kinds, all of which Firefox’s pdf.js opened with no prompt. Writing the file back without encryption made all of them readable.
Can Evidilo convert a statement PDF that asks for a password?
Not as it is. Evidilo has no field for a password and refuses the upload with “This PDF is locked with a password.” before it counts it. Remove the password first, for example with qpdf’s --password and --decrypt, the route we measured, and upload the unencrypted copy. Adobe Acrobat has its own way of removing security, which we did not test.
Does removing the encryption change the numbers on the statement?
It should not. In our test the opening balance read the same from every decrypted copy as from the unencrypted original. Evidilo then adds every row against the balances the bank printed, so a page that came out wrong would show as a day that does not tie out. DocuClipper or any other converter is worth the same comparison of totals after a decrypted upload.
Is it legal to remove the restrictions from a bank statement PDF?
That depends on who is entitled to the statement and on the terms it came with, and this page is not legal advice. For a client’s own statement used for their books, the account holder can also download it again or export a CSV, which needs no decryption. qpdf’s own manual says its decrypt option is not meant for bypassing restrictions placed by a file’s producer.
Will a scanned or printed copy of a locked statement convert instead?
Evidilo reads a scan or a photo of a paper statement as well as a PDF, so a printed and scanned copy is another way in. It is slower to check than a text PDF, because every figure is read from a picture, and converting a photographed statement covers what helps that reading. MoneyThumb and other converters that accept scans are worth the same test on one page first.