How to Merge and Password-Protect PDFs Without Uploading Them

A portal wants one PDF. You have a cover letter, a CV, and three photos of a form. The work is ordering and checking, not finding a more complicated tool. I merge in the browser with Merge PDF so the documents are not uploaded to someone's server in order to be stapled.

Turn photos into pages first

If the source is a set of JPGs, JPG to PDF makes one page per image. Name the photos 01, 02, 03 before you upload or the order will be whatever the file picker felt like. Crop out the table and your fingers. Zoom in on the smallest writing. An unreadable scan is not fixed by being inside a PDF.

Merge in the order a stranger would read

Cover letter, then CV, then certificates, unless the instructions say otherwise. Upload, drag into that order, merge, download. Open the result and look at the first page, a middle page, and the last page. Count the pages. If the count is short, one file was skipped or was still password-locked. Merge tools cannot see inside a PDF that asks for a password. Remove that restriction in a desktop reader you trust, using the password you already have, then merge the open copy. All In One PK does not offer a public unlock tool.

Password-protect when the file should not travel openly

Protect PDF adds a password in the browser. Generate a long password, store it in a password manager with the file name, then protect. Open the download in a different viewer. Some apps cache the unlocked document and will not ask again until you use another program.

Send the password in a different message from the file. The same email with the PDF and the password is only slightly better than no password.

There is no recovery if you forget it. We never see the password. If you lose it, the file is gone. That is the point of the lock and the reason to write it down first.

Look at the hidden label

PDF metadata shows the author and the app that wrote the file. Templates love to keep a previous employer's name in that field. Read it before you send a proposal. Metadata is not redaction. If the person's name is also in the visible text, the metadata check will not remove it. Read the pages too.

A packet I would actually send

Photos converted and legible. PDFs merged in the requested order. Page count equal to the sum of the parts. Metadata not advertising the wrong name. Password stored and tested in a second viewer, if you used one. File name that includes your name and the purpose, not scan.pdf.

Do the heavy reading yourself. The tools only stack pages and apply a password. They will happily stack them in the wrong order if you drag them that way. Open the file once as if you were the clerk. If you would reject it, do not send it.

Photos of paper, specifically

A bank or a university will zoom. Shoot in daylight, fill the frame with the page, and keep the camera square to the paper so the text is not a trapezoid. If a line is in shadow, take the photo again. Converting a bad photo to PDF does not focus it. When you have the pages, merge them and scroll on a phone, because that is how the clerk will read. If you have to pinch-zoom to read your own name, the scan failed.

Password protection is for the trip, not for your own archive, unless you enjoy locking yourself out. Keep an unprotected copy in a place only you can open, and send the protected copy. Write the password down before you click protect, not after the download finishes and the tab is gone. Then send the file, send the password separately, and ask the recipient to confirm they could open page one. A lock that nobody can open is not security. It is a lost document. The merge and protect tools will do exactly what you ask, including the mistaken order and the forgotten password, so the check is part of the task and not a courtesy. I also open the merged file and use the find box on a word I know is on the last page, to prove the last page is really there and not a blank the counter included. A page count can lie if a blank page was inserted. Your eyes on the last heading will not. If the instructions named an order, write that order on a scrap of paper and tick each file as you drag it. The scrap is not childish. It is how you avoid merging the certificate before the CV because the filenames sorted that way. When the ticks match the pages you see, then you send it.