Why do you need to decrypt server-side?

Browser PDF tools can't reliably decrypt AES-256 protected PDFs across all browsers. We forward only the encrypted bytes + password over HTTPS to our /api/decrypt-pdf endpoint, decrypt in-memory, return the decrypted bytes, and discard both server-side.

Where is my password stored?

Nowhere. It exists in your browser tab, traverses HTTPS in the request body, is used once for decryption, and is dropped. We do not log it.

Where do I find the statement password?

The password is printed in the email or SMS that delivered the statement, or set by your bank. For M-Pesa statements it is usually your national ID number. We cannot recover a password — only the issuer can (for M-Pesa, Safaricom support).

Convert an Encrypted PDF — Bank & Mobile Money Statements

Convert encrypted PDF statements safely.