How to open a password-protected SBI or HDFC statement PDF

Almost every bank statement that arrives by e-mail in India is a locked PDF. That’s deliberate: if the e-mail goes to the wrong inbox, the statement is still unreadable without a password built from details only the account holder should know.

For an accountant handling dozens of clients, though, it means a different password format for every bank, and sometimes for every kind of statement from the same bank. This guide covers the formats for SBI and HDFC, what to try when the password fails, and how to work with the file safely once it’s open.

Where the password comes from

Banks don’t let you choose a statement password. They build it from data they already hold: your registered mobile number, date of birth, customer ID or account number. Three things decide which one applies:

1. The bank.
2. How the statement reached you. A PDF e-mailed by the bank and a PDF you downloaded from net banking often use different passwords.
3. The product. Savings and current account statements, credit card statements and loan statements are frequently locked differently.

The most reliable source is always the covering e-mail or the download page itself. Banks usually state the format there. Read it before you start guessing.

SBI statement password

For an SBI account e-statement received by e-mail, the password is the last five digits of the registered mobile number followed by the date of birth in DDMMYY format. SBI’s own statement e-mails give this example: mobile number XXXXX12345 and date of birth 16 September 1982 give the password 12345160982.

For statements downloaded from OnlineSBI or YONO, published guides commonly give the 11-digit account number (without leading zeros or prefixes) as the password. If that fails, check the note on the download screen, because SBI has changed formats over time and YONO e-mailed statements have used a different pattern.

Credit card statements from SBI Card follow their own rule, stated in the statement e-mail.

HDFC Bank statement password

HDFC Bank’s own NetBanking FAQ is direct: for an account statement downloaded from NetBanking, “the password is your Customer ID (CustID)”. It’s the numeric ID you use to log in to NetBanking, entered as digits only.

• Your Customer ID is printed in the welcome kit and on your cheque book, and shown in NetBanking.
• If you or your client have more than one Customer ID (common when accounts were opened at different times), use the one linked to the account on that statement.
• E-mailed statements usually follow the same rule, and the e-mail says so. Credit card statements use a different format, given in the card statement e-mail.

Other banks

ICICI, Axis, Kotak and most other banks follow the same idea: a combination of letters from the name, the date of birth, the customer ID or digits of the mobile or account number. Exact formats vary by product and change from time to time, so rely on the bank’s e-mail rather than a list on a website. That includes this one.

When the password doesn’t work

Most failures come down to one of these:

• Wrong date format. DDMMYY (160982) and DDMMYYYY (16091982) are different passwords. So is DDMM.
• Extra characters. Type digits only: no spaces, slashes or hyphens. If letters are involved, check whether they should be upper or lower case.
• An old mobile number. The password uses the number registered with the bank, which may not be the one in current use.
• The wrong Customer ID, when the person has several.
• A different statement type. The format for a credit card or loan statement won’t open an account statement, and the reverse.
• The client’s details, not yours. For a client’s statement, it’s the account holder’s date of birth and mobile number that matter.

If none of that works, the simplest fix is often to download the statement again from net banking, where the password rule is shown on the download page, or to ask the client to.

Opening the file

Any standard PDF reader asks for the password when you open the file: Chrome, Edge, Firefox and Safari all do, as does Adobe Acrobat Reader. Once it’s open you can read and print it as normal.

There are actually two kinds of PDF password. An open password (also called a user password) is needed just to view the file; that’s what banks use. An owner password restricts printing or copying but lets anyone open the file. Some statements carry both.

Making an unlocked copy

Sometimes you need a copy without the password, for example to file it in a client folder or to feed it into another tool. Only do this for files you’re authorised to handle, and with the password you legitimately have. Options:

• Print to PDF from a browser. Open the file in Chrome or Edge, enter the password, choose Print and then Save as PDF. This works when the file allows printing, and keeps the text selectable.
• In your browser with KhataSheet. The PDF password remover opens the file with your password and saves an unlocked copy, all on your device. Nothing is uploaded.
• qpdf (command line, free). qpdf --password=YOURPASSWORD --decrypt locked.pdf unlocked.pdf. Useful for batches.
• Adobe Acrobat Pro. Open the file, then remove the security from the document’s protection settings.

Avoid uploading client statements to random “unlock PDF” websites. You’d be handing a stranger both the file and its password.

Should you keep statements unlocked?

The lock exists to protect the account holder. For a practice, a sensible middle ground is:

• Keep the original, locked PDF as the file of record.
• Unlock or convert only when you need to, and store working copies in an access-controlled client folder, not a shared drive or a chat group.
• Never send the password in the same e-mail as the file. If you must share both, use a different channel for each.
• Delete working copies you no longer need. India’s Digital Personal Data Protection Act, 2023 expects you not to keep personal data longer than its purpose requires.

Converting without unlocking first

You don’t need an unlocked copy to convert a statement. In KhataSheet, drop the locked PDF in and type the password when it asks. The password is used only in your browser to open the file. It’s never saved or sent anywhere, and you get Excel, CSV or Tally XML straight away.

This guide is general information, not professional advice. Menus can change between software versions; check your version's help if a screen looks different. Tally, Tally.ERP 9 and TallyPrime are trademarks of Tally Solutions Pvt. Ltd. KhataSheet is not affiliated with Tally Solutions or any bank.