Why your bank statement PDF won't let you copy, merge or convert (and what to do)

Published 13 October 2026 · by Tekiba

Two different passwords

A PDF can carry two passwords, and they do different jobs. Adobe's help page on securing PDFs with passwords puts it this way: “A Document Open password (also known as a user password) requires a user to type a password to open the PDF.” The other kind is the one on most downloaded statements: “Using a permissions password, you can restrict printing, editing, and copying content in the PDF. Recipients don’t need a password to open the document in Reader or Acrobat.”

So a statement that opened without a prompt does not have the first kind. That alone does not show it has the second: a file with no protection, or a scan, opens the same way. A permissions password shows itself when an operation is refused, or in the security details your PDF viewer lists for the file. Every page still displays. What the file carries is a list of permissions, and the specification spells them out. Table 22 of ISO 32000-1 has separate switches to print, to modify, to “Copy or otherwise extract text and graphics from the document”, and to “Assemble the document (insert, rotate, or delete pages and create bookmarks or thumbnail images)”. A bank can turn any of them off.

That last switch is why merging fails. Combining twelve statements into one file inserts pages, which is assembly, and a program that follows the permissions will not do it when that switch is off. The question has been running on Adobe's community forum since April 2022 in a thread about Chase statements, where one reply sums it up: “I am unable to combine statements into one document.” Saving a copy does not help either, as Adobe notes: “The copies have the same restrictions as the original PDF.”

What to do

1. Find out which problem it is. If the file opened without asking for anything, it has a permissions password at most — and if none of the three checks in Is your bank statement PDF scanned or text? finds any text, the trouble is a scan, not a password. If a viewer asked for a password before showing the first page, it has a Document Open password, and only the bank, or whoever set it, can tell you what it is.
2. Look for the data before the document. Where online banking offers the transactions themselves as a download, no PDF permission touches them. Chase's Spending Planner, for example, offers CSV, QFX, QIF or QBO for two years of activity; how far back you can download bank transactions compares what five banks offer.
3. Ask the bank. If the download does not reach the months you need, ask for the transactions as a spreadsheet, or for the statements in a form you can use. The protection was the bank's choice, so the bank is the one that can give you a file without it.
4. Keep the originals as they are. Whatever you end up converting, file the statements exactly as the bank issued them. For a tax return or a dispute, the bank's own document is the one that counts.
5. If printing is allowed and you only need paper or a single file to look at, printing gives you that. A PDF made by printing is a new file made by your print driver, not the bank's statement, and whether it still holds text depends on the driver: run the three checks in the scanned-or-text guide before you rely on it. In the Adobe thread, one reply says that even after printing with Microsoft Print to PDF the statements would not merge.
6. If you need the numbers rather than the pages, convert the statement to a CSV instead of trying to merge PDFs. One CSV per statement can be joined into a year in a spreadsheet; merging twelve months of statements into one CSV covers the checks that keep it right.
7. Choose where the file goes. A statement carries your account number, your address and every payment you made. A converter that uploads it has a copy on someone else's server; one that runs in your browser does not. How to convert a bank statement to CSV without uploading it explains the difference between a page reading a file and sending it.

What LedgerDrop does with a protected statement

Tested on synthetic statements, encrypted as the specification describes.

A permissions password on its own. On a statement that holds text, LedgerDrop reads it the same as an unprotected copy and gives the same rows. A scan is refused either way, because LedgerDrop does not run OCR. It reads text with pdf.js, which opens such a file with the empty open password and does not apply the copy or assembly switches. The specification says plainly that the switches are not part of the encryption: “There is nothing inherent in PDF encryption that enforces the document permissions specified in the encryption dictionary.” Adobe's page notes that its own products enforce them.

LedgerDrop does not remove the password, change the PDF or write a new one. It reads the text in your browser tab and writes the transactions into a CSV, which is a different file; the statement on your disk is untouched. Whether your bank's terms say anything about extracting your own transactions is between you and the bank — the bank's own download, where there is one, raises no such question.

A Document Open password. LedgerDrop cannot read the file. There is no field to type a password into, and the page stops with “This PDF needs a password to open.” If you know the password, the page suggests printing the statement to a new PDF and dropping that copy; check the copy has text. Otherwise ask the bank for the transactions.

What this page cannot tell you

Which permissions a particular bank switches off, and why, is not published in the file or anywhere we could read; the Chase thread is one bank, and others differ. Nothing here is legal advice about what your account terms allow.

Questions