Share Large PDFs Securely: Encrypted PDF Transfer Guide

To share a large PDF securely, combine two things: encryption at rest on the PDF itself (AES-256 set via Acrobat, Preview, or qpdf), and encryption in transit on the transfer (end-to-end encrypted services like HexaTransfer). Email attachments top out around 25 MB and leak metadata. Google Drive and Dropbox encrypt in transit but can decrypt at rest. For contracts, medical records, and financial statements, the combination matters more than either layer alone.

Why PDFs get big in the first place

Most "large" PDFs are scans. A 20-page scan at 600 DPI with no OCR can be 50-200 MB. Vector-exported PDFs (from Word, Pages, InDesign) are usually under 5 MB even at 100+ pages. Common offenders:

Full-page scans saved as images inside a PDF wrapper instead of text.
Embedded fonts duplicated across merged PDFs.
High-resolution images (product catalogues, annual reports) not downsampled.
Hidden layers and annotations from Acrobat that never got flattened.

Before encrypting and uploading, run a "Reduce File Size" pass in Acrobat or gs (Ghostscript) with -dPDFSETTINGS=/ebook. A 120 MB scan often shrinks to 15 MB with no visible quality loss.

Two layers of encryption, explained simply

Layer 1 — PDF-level encryption. The PDF itself is encrypted with a password. Opening it requires the password. Acrobat Pro, macOS Preview, LibreOffice, and qpdf can all set AES-256 encryption on a PDF. This protects the file even after download, even if the recipient forwards it.

Layer 2 — transit encryption. The upload and download channel uses TLS, and ideally end-to-end encryption, so the transfer provider can't read the PDF in flight or at rest on their servers.

Doing only Layer 1: the recipient gets a password-locked PDF but the transfer provider saw it upload unencrypted. Doing only Layer 2: the transfer is private, but once downloaded the PDF sits on the recipient's laptop with no protection. Do both when stakes are high.

Adding AES-256 password protection to a PDF

macOS Preview: File > Export > check "Encrypt" > set password. Uses AES-256 on recent versions.

Adobe Acrobat Pro: Tools > Protect > Encrypt > Encrypt with Password > choose "256-bit AES".

qpdf (command line, free, cross-platform):

qpdf --encrypt userpass ownerpass 256 -- input.pdf output.pdf

Replace userpass with the open-password and ownerpass with the permissions-password. Keep them different for finer control.

LibreOffice: File > Export As > Export as PDF > Security tab > "Encrypt with password".

Avoid the old 128-bit RC4 option that some tools still offer as default — it's broken and bypassable by commercial password-recovery tools.

Password delivery — the link doesn't carry it

The cardinal rule of password protection: do not send the password in the same channel as the file. If you email the PDF and email the password, anyone who intercepts the email has both. Use two channels:

PDF link by email, password by SMS.
PDF link via HexaTransfer, password via a Signal message.
PDF link via Slack, password spoken over a phone call.

For one-time recipients, a temporary password generator (1Password, Bitwarden) is better than a memorable phrase.

Free services for large encrypted PDF delivery

| Service | Max size | Transit encryption | At-rest on server | |---|---|---|---| | HexaTransfer | 10 GB | End-to-end (AES-256-GCM) | Encrypted, key not on server | | WeTransfer | 2 GB free | TLS 1.3 | Server can decrypt | | Tresorit Send | 5 GB free | End-to-end | Encrypted | | Firefox Send | Discontinued in 2020 | — | — | | Proton Drive Share | 1 GB free | End-to-end | Encrypted | | Dropbox Transfer | 100 MB free | TLS | Server can decrypt |

For a sensitive 200 MB PDF (say, a medical report or signed contract), HexaTransfer or Tresorit Send gives you true E2E. WeTransfer is convenient but not appropriate for regulated data.

PDF metadata that leaks information

A PDF carries metadata you might not want shared: author name, software used, creation date, revision history, and sometimes the full path of the original file. Before sending externally:

Acrobat: File > Properties > Description tab > clear author/keywords.
exiftool: exiftool -all= document.pdf strips all metadata.
"Remove hidden information" (Acrobat Pro) catches annotations, bookmarks, form data, and embedded files.

A law firm sending a draft contract externally with the recipient's firm name in the filename and the drafting attorney in the metadata has leaked more than they realise.

Signed PDFs and tamper evidence

If the PDF is a legal document with a digital signature (PAdES, per ETSI EN 319 142), password-encrypting the file after signing doesn't break the signature — but adding pages or annotations will. Sign last, encrypt last. The recipient verifies the signature in Acrobat's signature panel against the signer's certificate, which chains to a trusted CA (e.g., DocuSign, Adobe Approved Trust List).

GDPR and HIPAA context for PDF sharing

Under GDPR Article 32, controllers must implement "appropriate technical measures" including encryption where the risk warrants it. For personal data in a PDF (names, IDs, health information), end-to-end encryption during transit meets the bar. HIPAA's Technical Safeguards (45 CFR 164.312(e)(1)) similarly require transmission security for ePHI. Both regimes are happier with defence-in-depth: encrypt the PDF, encrypt the channel, log the transfer.

Revocation and retention

A physical envelope can't be unsent; a digital PDF can, depending on the service. HexaTransfer lets you delete the uploaded blob before expiry, killing the link. A password-protected PDF downloaded before deletion remains on the recipient's disk — encryption-at-rest buys you a second layer when you've lost control of the primary copy.

Try it at hexatransfer.com — end-to-end encrypted delivery, 10 GB free, 14-day auto-expiry.