How to Password-Protect a Batch of Client PDFs at Once, With One Password per Client

Every April, the same scene plays out in small accounting and bookkeeping practices. The returns are done, the year-end packets are exported, and now someone has to send them. Sixty clients, sixty PDFs, and each one holds a Social Security number, income figures, bank details. Protecting them one at a time is slow. Protecting them all with the same password defeats the purpose. This guide shows a middle path: protect the whole batch in one run, with each client's own password, without uploading anything.

Why the usual approaches break down at tax time

Most firms start with one of three habits, and each one has a cost that only shows up under volume.

• One file at a time. Open the PDF, type the password, confirm it, save, rename, move on. It works for five clients. At sixty, it eats an afternoon, and the risk of pairing a file with the wrong password grows with every repetition.
• One password for everyone. Fast, but if one client forwards their email or shares the password, every other client's file is now protected by a secret that's out in the wild. It also tends to end up being something guessable, like the firm's name and the year.
• An online "protect PDF" site. It saves a few clicks and costs you the one thing the password was supposed to guarantee: the documents now sit, at least for a while, on someone else's server.

What you actually want is the speed of the second option with the separation of the first, done on your own computer. That's what batch protection with a client password spreadsheet is for.

The idea: one fixed password per client, kept in a spreadsheet

The method rests on a simple decision: each client gets one strong password that doesn't change from one mailing to the next. The client learns it once (or saves it in their password manager) and uses it for every document you send them during the year. You keep the list in a spreadsheet, the same way you already keep their contact details.

This has two practical benefits. Clients stop calling to ask "what was the password this time?", and you can protect a whole batch automatically, because the app can look each client up in your list.

What the spreadsheet looks like

In PDF Protect Plus, the spreadsheet is a plain CSV file with one row per client and two required columns: client and password. An optional third column, file, handles the odd case where a file name doesn't contain the client's name. Here is an example with fictional names:

client;password;file
Martin Dubois;Lake-Copper-Window-82;
Sarah Nguyen;quiet.orbit.violin.47;
Okafor Holdings LLC;Teal!Harbor!Mosaic!19;
James Whitaker;7-maple-sundial-crane;JW_1040_2025_final.pdf

A few details that save time:

• The separator can be a semicolon, a comma or a tab, so whatever your spreadsheet program saves will usually work.
• The file can be encoded in UTF-8 or Windows-1252, the default for many spreadsheet programs on Windows, so accented names come through correctly.
• Headers can be in English or French.
• No spreadsheet yet? The Download the template button in the app gives you a file with the right columns, ready to fill in.

Each password needs at least 12 characters. Three or four unrelated words with a separator and a number are easy to read out over the phone and much harder to guess than a short string of symbols.

Step by step: protecting sixty packets in one run

Take a four-person firm sending around sixty client packets in April. Each PDF is already named after the client, for example 2025 Tax Return - Martin Dubois.pdf. Here is how the batch goes.

1. Add the PDFs

Open the Batch protection tab. The screen shows three steps across the top: Add the PDFs, Import the password spreadsheet and Check, then protect. Drag the sixty PDFs into the drop area. A batch can hold up to 200 files. If one of them is already password-protected, it's set aside rather than processed a second time.

2. Import the spreadsheet

Choose the My clients' passwords mode, then import your CSV. You can also drop the CSV in together with the PDFs: the app recognizes it and switches to client mode on its own. The other two modes, The same password for all and A generated password per file, are there for other situations. The generated mode creates a random 20-character password for each file and saves the list to a batch_passwords.txt file. That file is plain text, so store it somewhere safe and never send it alongside the PDFs.

3. Check the table

This is where the method earns its keep. The app matches every file to a client and shows the result in a table, one row per file:

• If the file column names the PDF exactly, that match wins.
• Otherwise, the client's full name has to appear in the file name. Capitals, accents and punctuation are ignored, so 2025 tax return - MARTIN-DUBOIS.pdf still finds Martin Dubois.
• A partial match, such as two clients who share a last name, shows To confirm.
• No match at all shows Client not found.
• A password under 12 characters shows Too weak, with a Generate button next to it.

Rows that need action are highlighted in orange, and you fix them by picking the right client from a list. In our sixty-packet example, you might see fifty-seven rows ready, two to confirm because of a shared surname, and one weak password left over from years ago. That's a two-minute review, and it happens before anything is encrypted, which is the point.

4. Tick the two options that matter

Save these passwords in the vault stores one entry per client in the app's encrypted local vault. Next time, the app finds each client there and you don't need the CSV at all. Create the sending summary (client, file) writes a recapitulatif-envoi.csv file listing which client gets which file. It contains no passwords, so it's safe to use as a checklist while you send emails.

5. Protect

Pick a destination folder. The app creates a new subfolder inside it and writes the protected copies there, numbered in order: 001_2025 Tax Return - Martin Dubois_protected.pdf, 002_…, and so on. Each copy is encrypted with AES-256. Your original files are left exactly as they were. The batch is all-or-nothing: if something fails along the way, you don't end up with half a folder protected and half not. When it's done, a window confirms 60 files protected successfully and offers Open the folder.

Sending the files, and the passwords, separately

A protected PDF and its password should never travel together. If both are in the same email, anyone who gets into that inbox gets both. The usual pattern is simple: the PDF goes by email, the password goes by text message or is shared once in person or over the phone at the start of the engagement. Because each client keeps the same password all year, you only have to do that once per client, not once per mailing.

We wrote a separate guide with ready-to-use email and SMS templates: how to send a PDF password separately.

Everything stays on your computer

Reading the spreadsheet, matching files and encrypting them all happen on your own machine. Neither your PDFs nor your password list are sent to our servers. Your account and license need an internet connection; your documents don't. If you want the details of what stays local and what doesn't, see how local processing works.

A short checklist for next season

1. Give every client one fixed password of at least 12 characters, and record it in your spreadsheet.
2. Name every exported PDF with the client's full name.
3. Drop the PDFs and the CSV into Batch protection, fix the orange rows, tick the vault and the sending summary.
4. Protect, then email the files and send the passwords by another channel.

The full tutorial, with each screen in order, is on the batch protection page, and there is an overview for practices on the PDF Protect Plus for bookkeepers page. If clients send protected files back to you, the companion article on protecting and unlocking client PDFs in bulk covers the return trip. You can download the app and run the whole workflow on a test batch during the trial.