How to protect personal documents before sharing them online

Written by Matheus Rodrigues. Updated 14 October 2026.

Note: This is general information, not legal or professional advice. Check the requirements of the institution and channel before sending a document.

📅 21 May 2026 | ⏱️ 6 min read | 👤 Matheus Rodrigues

An identity document can contain numbers and details that are difficult to change if exposed. Before sending an ID, proof of address, payslip or contract, confirm who needs it, what they need to see and which channel they accept. A few checks reduce unnecessary exposure, but no watermark, password or messaging app can guarantee that a recipient will not copy a file.

Share only what the request requires

Verify the request through a contact method you have independently confirmed. A familiar logo or profile photo does not prove that a message came from the institution. Ask which document and fields are required, and whether an official portal is available.

If the document contains unrelated balances, transaction history, addresses or identifiers, ask whether those parts may be omitted. Do not alter a document in a way that misrepresents it or hides information the recipient is entitled to verify.

Redact information so it cannot be recovered

A black shape drawn over text may only cover it visually; the original text or image layer can remain in the file. Use a redaction function that removes the underlying content, or create a flattened copy and inspect every page. Try selecting, copying and searching for the covered text. If it remains, the redaction did not remove it.

A purpose watermark, such as “copy for rental application, 14 October 2026”, may explain why the copy was shared and discourage some reuse. It does not prevent copying, cropping or fraud, and a receiving organization may reject altered documents. Ask first and keep required fields legible.

Choose the channel and check metadata

Prefer the institution’s verified portal or another channel it explicitly provides. Avoid public posts and group chats because more people may receive or forward the file. If a password-protected file is required, use a strong unique password and send it through a separately verified channel; a password does not make an untrusted recipient safe.

Messaging services can encrypt messages in transit, but encryption does not control what a recipient does with a downloaded copy. WhatsApp says chats can be backed up to cloud services; end-to-end encrypted backup is an additional setting that must be enabled. Check the current settings on your devices and account.

Photos may include metadata such as device, date or location, depending on settings and file type. Documents can also contain author names or editing details. Do not assume that converting an image to PDF removes all metadata: inspect the result with a suitable tool and share only what is needed.

After sending

Keep a note of what you sent, to which organization, through which channel and when. If you sent a file to the wrong recipient, contact them and the organization promptly, ask what steps are available and follow their incident process. Be cautious of follow-up messages requesting passwords or extra documents.

Registrato is a set of Banco Central reports, not a real-time fraud-alert service. The CCS report can show relationships with covered financial institutions and is updated daily, but a new record may take up to two business days to appear. The SCR report has a different schedule. If a report shows an unfamiliar relationship, contact the institution responsible and follow Banco Central guidance.

You can ask an organization how it handles your personal data and, where applicable, exercise rights under Brazil’s LGPD. Deletion is not automatic in every situation; legal retention exceptions may apply. Start with the organization’s privacy channel and identify the file and request.

Tools to check a file locally

These ConverteArq tools run in the browser and can help inspect PDF properties or calculate a file hash. A hash can help verify whether two files are identical; it does not remove metadata or prove that a document is authentic. Review the specific tool page before using it with sensitive files.

Read PDF metadata — Inspect common PDF properties in the browser; the tool does not determine whether a file is safe to share.
File hash generator — Calculate a local SHA-256, SHA-384 or SHA-512 hash without uploading the file.

Related guide

For a broader checklist about file processing and privacy, read our guide to choosing online tools safely. choosing online tools safely.

Frequently asked questions

Does a purpose watermark prevent identity fraud?

No. It may show the intended purpose and discourage some reuse, but it can be copied or cropped and does not guarantee acceptance or prevent fraud.

Is WhatsApp safe for sending an identity document?

End-to-end encryption protects a chat in transit, but the recipient can keep a copy. Cloud backups have separate settings. Use the channel specified by the organization and verify the recipient.

How can I check whether a redaction worked?

Open the exported copy and inspect every page. Try selecting, copying and searching for the covered text. A visual black box alone may leave the original content underneath.

Can I ask a company to delete a document I sent?

You can ask how the file is handled and request deletion where applicable. Brazil’s LGPD provides rights with conditions and exceptions, including some legal retention cases; the result depends on the circumstances.