Law firms, paralegals, virtual assistants and independent consultants all run some version of the same routine: documents go out to many clients, and documents come back. Engagement letters at the start of a matter, document productions in the middle, monthly reports for every retainer client at the end of the month. Then the return trip: signed forms, statements and records that clients send back, sometimes password-protected. This article covers both directions, protecting a batch with one password per client and unlocking a batch of files clients return, all on your own computer.
Where volume shows up in a small practice
Few small firms or solo consultants think of themselves as doing "bulk" work, but the pattern is there:
- Engagement and onboarding: engagement letters, fee agreements, intake questionnaires, conflict-check forms, sent to every new client.
- Matters in progress: document sets for clients to review, exhibits, deposition summaries, productions split per custodian or per party.
- Recurring deliverables: a virtual assistant preparing monthly bookkeeping summaries for eight clients, a consultant sending a performance report to twenty retainer clients on the first business day of the month.
Each of these files is confidential, and each belongs to a different person. Sending them unprotected, or protecting them all with one shared password, mixes up exactly what should stay separate.
Part 1: protecting a batch, one password per client
The approach that scales is to give each client one fixed password, at least 12 characters long, and keep it for the whole engagement. You record it in a spreadsheet next to their name. Clients learn one password instead of a new one per email, and you can protect any number of files automatically because the app can look each client up.
The spreadsheet
It's a CSV file with one row per client: a client column with their full name and a password column. An optional file column covers files whose names don't include the client's name. Separators can be semicolons, commas or tabs; encoding can be UTF-8 or Windows-1252; headers can be English or French. In PDF Protect Plus, the Download the template button gives you a blank file with the right columns.
The batch, in three steps
Take a consultant sending monthly reports to twenty clients, each file named something like Monthly report - October - Sarah Nguyen.pdf. In the Batch protection tab:
- Add the PDFs. Drag all twenty reports in. A batch takes up to 200 files, and any PDF that's already protected is set aside.
- Import the password spreadsheet. Choose My clients' passwords and import the CSV, or simply drop it in with the PDFs; the app switches to client mode on its own.
- Check, then protect. The table shows which client each file was matched to. An exact
fileentry wins; otherwise the client's full name must appear in the file name, with capitals, accents and punctuation ignored. Orange rows need you: To confirm for a partial match, Client not found for none, Too weak for a password under 12 characters (with a Generate button). You pick the right client from a list, then protect.
The protected copies, encrypted with AES-256, go into a new subfolder of the folder you choose, named 001_…_protected.pdf, 002_… and so on. The batch is all-or-nothing, and the original files are left untouched.
Two options make the next month easier. Save these passwords in the vault stores one entry per client in the app's encrypted local vault, so you won't need the CSV again. That's especially handy for a virtual assistant who'd rather not keep a password spreadsheet lying around. Create the sending summary (client, file) writes a recapitulatif-envoi.csv listing which file goes to which client, with no passwords, which makes a good checklist while sending.
The step-by-step version with every screen is on the batch protection tutorial, and the article written for accountants at tax time walks through a sixty-file example.
Part 2: unlocking a batch of files clients send back
The return trip is the part most tools ignore. If you've asked clients to protect what they send you, or you've protected documents yourself and now need to work on them, you end up with a folder of encrypted PDFs. To annotate them, merge them into a binder, run text recognition, or file them in a system that can't index encrypted documents, you need unprotected working copies.
Opening each file, typing its password, saving an unlocked copy and moving on is the same tedium as protecting them one by one. The Unlock a batch tab handles the whole set.
Two ways to supply the passwords
- My clients' passwords. The app uses your client spreadsheet, or the entries already saved in the vault, and matches files to clients the same way as for protection. Before anything is written, it tests every password against its file. A wrong one shows ✕ Password refused on that row, so you can fix the spreadsheet or pick another client.
- Type each password. One field per file, for the occasional batch where passwords don't come from your list.
Either way, the rule is strict: the batch is created only if every password is correct. You won't end up with a folder where some files are unlocked and others silently skipped. The working copies are named 001_…_unlocked.pdf, 002_…, and the protected originals stay as they were.
What batch unlock is not
It doesn't recover, guess or crack passwords. If you don't know a file's password, the app can't open it, and that's by design. Use it for documents you're entitled to open: files your clients protected with a password they gave you, or files you protected yourself.
Example: one month, both directions
Here's what a month can look like for a small consulting practice, as an illustration. On the first business day, the twenty monthly reports go out as a protected batch, the passwords already in the vault from previous months; the whole check takes a couple of minutes because nothing is orange. During the month, eight clients send back signed change requests, protected with their usual password. At the end of the month, those eight files go through Unlock a batch in client mode, every password is confirmed before the copies are written, and the unlocked versions go into the project archive.
Redact before you share
Legal and consulting work often involves sending a document to someone who should see only part of it: a production with personal identifiers removed, a report with another client's figures blacked out. A black rectangle drawn in an ordinary editor frequently leaves the text underneath selectable. Before you rely on it, read how to redact a PDF properly.
Passwords travel separately, documents stay local
Send each protected file by email and its password by another channel, such as a text message, or once by phone at the start of the engagement. Our guide to sending a PDF password separately has templates for both.
Throughout, matching, encrypting and decrypting happen on your computer. Your PDFs, your spreadsheet and your passwords are never sent to our servers; your account and license need an internet connection, your documents don't. More on that in how local processing works. You can download the app and try both tabs on a test folder during the trial.