Three months of statements as one PDF for a loan application

Loan and rental forms often ask for the last three months of bank statements as a single upload. Banks usually hand them out one month at a time, and often with a password on each file. Here's how I join them into one PDF with free tools, and the three things that trip the job up: passwords, order, and size.

Step 1: find out which files are locked

A statement PDF can be protected in two ways:

• An open password (user password). The file won't show its pages until you type it. Bank statements often come like this.
• Owner restrictions only. The file opens without a prompt, but printing or copying is switched off. It's still encrypted.

pdfinfo from poppler-utils shows both. For my test files, the first has an open password and the second has owner restrictions only:

$ pdfinfo jul-locked.pdf
Command Line Error: Incorrect password

$ pdfinfo aug-restricted.pdf | grep Encrypted
Encrypted:       yes (print:no copy:no change:no addNotes:no algorithm:AES-256)

qpdf --show-encryption file.pdf gives more detail if you want it.

Step 2: why the merge fails on locked files

I tried merging all three files as they were. pdfunite, the merge tool that ships with poppler, refused both encrypted files, including the one that opens without a prompt:

$ pdfunite jul-locked.pdf aug-restricted.pdf sep.pdf out.pdf
Command Line Error: Incorrect password
Syntax Error: Could not merge damaged documents ('jul-locked.pdf')

$ pdfunite aug-restricted.pdf sep.pdf out.pdf
Unimplemented Feature: Could not merge encrypted files ('aug-restricted.pdf')

That second one is the gotcha. A file that opens fine on screen can still be rejected by a merge tool, because it's encrypted even though it has no open password.

Not every tool behaves the same. qpdf and pypdf both merged the owner-restricted file without complaint, and both stopped at the file with the open password (qpdf: jul-locked.pdf: invalid password, and pypdf raised FileNotDecryptedError). One note on pypdf: it needs the cryptography package installed to read AES-encrypted files, otherwise it fails with "cryptography>=3.1 is required for AES algorithm".

So the simplest rule is: remove the protection from each file first, then merge.

Step 3: remove each password (you need to know it)

With qpdf, for a file with an open password:

qpdf --decrypt --password=YOUR_PASSWORD jul-locked.pdf statement-2026-07.pdf

For an owner-restricted file, no password is needed:

qpdf --decrypt aug-restricted.pdf statement-2026-08.pdf

A wrong password gives invalid password and exit code 2, and no output file. After both commands, pdfinfo showed Encrypted: no on the new copies.

Typing the password on the command line leaves it in your shell history. qpdf can read it from a file instead with --password-file=pw.txt, which worked the same way in my test. Delete that file afterwards.

This only works for passwords you already have. It's a decrypt step, not a way to get into a file you can't open.

Step 4: put them in order, oldest to newest

Whoever reviews the application reads the file top to bottom, so I put the oldest month first. The easy way to get that order for free is to name the files by year and month, statement-2026-07.pdf, statement-2026-08.pdf, statement-2026-09.pdf, because the shell sorts the wildcard alphabetically:

pdfunite statement-2026-*.pdf statements-jul-sep-2026.pdf

The last name on the line is the output. Note that pdfunite overwrites it if it already exists.

To check the order, I printed the first line of each page:

$ for p in 1 2 3 4 5 6; do pdftotext -f $p -l $p statements-jul-sep-2026.pdf - | head -1; done
SAMPLE BANK - Account statement - July 2026 - page 1
SAMPLE BANK - Account statement - July 2026 - page 2
SAMPLE BANK - Account statement - August 2026 - page 1
SAMPLE BANK - Account statement - August 2026 - page 2
SAMPLE BANK - Account statement - September 2026 - page 1
SAMPLE BANK - Account statement - September 2026 - page 2

On scanned statements there's no text to extract, so open the merged file and flip through it instead.

qpdf can also do the decrypt and the merge in one command. A --password= written after a file name applies to that file:

qpdf --empty --pages jul-locked.pdf --password=YOUR_PASSWORD aug-restricted.pdf sep.pdf -- statements.pdf

That gave me a 6-page file with Encrypted: no.

On a Mac without the terminal: Apple's Preview guide describes combining PDFs by opening them, choosing View > Thumbnails, and dragging thumbnails (or a PDF's icon from the Finder) into another document's sidebar, then dragging thumbnails to reorder. Preview saves changes automatically, so Apple suggests File > Duplicate first if you want to keep the originals.

Step 5: check the size against the portal's limit

Merging copies pages; it doesn't compress them. The output is about the sum of the inputs. My text-only test statements were tiny, so I also made three scan-like statements with two image pages each:

File	Size (bytes)
scan-2026-07.pdf	2,412,623
scan-2026-08.pdf	2,412,521
scan-2026-09.pdf	2,412,750
Sum of inputs	7,237,894
Merged with pdfunite	7,236,678
Merged with qpdf	7,235,689

Three files of about 2.4 MB each became one file of about 7.2 MB. Upload limits differ from portal to portal, so check the portal's limit before you merge. If the merged file is over it, compress it as a separate step, and check that the figures are still readable afterwards.

A few more things I check before uploading

• Page count. pdfinfo merged.pdf | grep Pages should equal the page counts of the inputs added together.
• The merged file has no password. That's usually what a single-file upload needs. If you're emailing it instead, you can add a password to the merged copy with qpdf --encrypt.
• Keep the originals. I work on copies and keep the bank's files untouched.

A browser option

I built ToolOcean, and it has a merge page that combines PDFs in the order you drag them into, in the browser without uploading the files. It doesn't take encrypted files, so a locked statement goes through its unlock page first, using a password you already know: toolocean.co/pdf-merge.

Drafted with AI help, tested and checked by me.