Banks email statements, and email is not a private channel — so the PDF ships encrypted and the password travels separately. Where passwords come from, how PesaInsights unlocks the file in server memory, and what cannot be unlocked.
Banks and mobile-money providers deliver statements by email, and an email attachment passes through servers neither you nor the bank controls. Encrypting the PDF and sending the password through a separate channel — SMS, a known formula, a branch visit — is the industry’s answer. The lock is a feature; it just becomes your problem the moment you want to do anything with the file.
Three common patterns: it is printed in the email or SMS that delivered the statement; it follows a formula the bank told you once (an ID number, a phone number, a date of birth in a stated format); or you set it yourself in online banking. For M-Pesa statements it is usually your national ID number. Only the issuer can recover or reset it — PesaInsights cannot, by design.
Browser PDF tools cannot reliably decrypt AES-256 protected PDFs across all browsers, so this is the one step that does not run on your device: the encrypted bytes and your password travel over HTTPS to our decrypt endpoint, the file is unlocked in server memory, the decrypted bytes come back to your browser, and both are discarded. Nothing is written to disk, nothing is logged, nothing is kept — parsing and conversion then continue in your browser as usual.
A wrong password cannot be brute-forced — we try exactly what you type, once. And a scanned or photographed statement cannot be parsed even when it opens, because there is no text layer to read; those files are detected and rejected with guidance rather than half-parsed. If that is what you have, ask the issuer for a digital original or a CSV export.
Export the same statement as CSV, Excel, or OFX from online banking. Those formats arrive unencrypted and are parsed entirely in your browser — nothing touches our servers, which is the default for everything except the encrypted-PDF unlock.
Convert a statement · Analyze a statement · Help & FAQ · Privacy promise