Is it safe to email a copy of your passport or ID?

Email gets your ID where it needs to go. The problem is everything that happens afterwards.

It sticks around for years

An attachment doesn't disappear once it's been read. There's a copy in your Sent folder, one in the recipient's inbox, more in their colleagues' inboxes if it gets forwarded, and copies in backups on both sides. Few people ever delete them, so a passport you emailed to a letting agent five years ago is probably still sitting there.

Email accounts get hacked

Anyone who gets into your email account, or the recipient's, can search for "passport" and download every copy in seconds. The inbox of a small letting agent or recruitment firm is rarely protected as well as a bank.

Email isn't end-to-end encrypted

Most email is now encrypted while it travels between servers, though not always, as Google's transparency report shows. Even when it is, the email is stored where your provider and the recipient's can read it. End-to-end encrypted email like Proton Mail only protects the whole journey when both of you use it, or when you send a password-protected email.

A copy of your ID is an identity kit

A passport photo page shows your full name, date of birth, nationality, photo, signature and passport number. That's enough for a criminal to try to open accounts, take out credit or pass online identity checks in your name, wherever nobody checks the original.

Plenty of requests for ID are legitimate. In the UK, landlords have to check that tenants have the right to rent and keep copies of their documents for the whole tenancy and a year after. Employers, banks and solicitors have similar rules.

But asking for ID is also one of the oldest tricks in the book. The FTC warns that rental scammers ask for "a picture of your driver's license, paystubs, and other personal details" and use them to steal identities. Fake job offers work the same way. Be careful if:

• They want your ID before you've viewed the property, had an interview or agreed to anything. As the FTC puts it, until you've agreed to rent a place, a landlord doesn't need your sensitive information.
• The request comes from a personal email address or a messaging app instead of the company's official contact details.
• They're in a hurry, or the deal seems too good to be true.
• They can't tell you why they need it or how long they'll keep it.

If you're unsure, contact the company using a phone number or website you found yourself, not the details in the message.

1. Use their secure portal if they have one

Banks, large employers, government services and many letting agents have their own upload portal or ID check app. If they offer one, use it. It's built for exactly this, and your ID won't end up in someone's inbox.

2. Only send what they need

For a passport, that's usually just the photo page. Ask whether they need every detail: some recipients are happy for you to cover the passport number or the machine-readable lines at the bottom. Official checks, like right to rent or right to work in the UK, may need a full, unaltered copy, so ask before you edit anything.

3. Add a watermark

Write who the copy is for, what it's for and the date across the image, for example "Only for Northside Lettings, tenancy application, October 2026". Put it over the photo without hiding the details they need. A watermarked copy is much harder to reuse anywhere else, and if it ever leaks, you'll know where it came from.

Any photo or PDF editor can do this. The French government even runs a free tool for it called FiligraneFacile.

4. Remove hidden data from photos

If you took a photo of your ID with your phone, the file can include the GPS location it was taken at, which is usually your home. Clean it with our free photo metadata remover first. It works in your browser, so your ID isn't uploaded anywhere.

5. Send it as a link that deletes itself

Instead of attaching the file, send it as an end-to-end encrypted link that only works once. With VeilShare it's free, and neither of you needs an account:

1. Drop your ID onto the upload box on our homepage.
2. Set Delete after downloads to 1, and pick the shortest expiry that gives your recipient enough time: 6, 24, 48 or 72 hours.
3. Turn on Password protect and choose a password.
4. Click the upload button, email the link, and send the password another way, like a text message or a phone call.

Your ID is encrypted in your browser before it's uploaded, so we never see it. Once your recipient downloads it, the link stops working and the file is permanently deleted within an hour.

6. Ask them to delete it

Once they've checked your ID, ask the recipient to delete any copies they don't legally need to keep. And if you did email it, delete it from your Sent folder and empty the trash.

WhatsApp and Signal are fine if your recipient uses them, since messages are end-to-end encrypted. Just remember the photo stays in both chats until it's deleted, and WhatsApp's cloud backups are only end-to-end encrypted if you've turned that on.

An emailed copy isn't the same as a stolen passport, but it's worth closing the gaps:

• Delete the email from your Sent folder and empty the trash.
• Ask the recipient to delete their copy if they don't need to keep it.
• Watch for signs of identity theft, like letters or emails about accounts or credit you didn't apply for.
• If you sent it to a scammer, report it. In the US, go to IdentityTheft.gov for a recovery plan. Elsewhere, report it to the police or your national fraud reporting service.

Sending other files that are too big for email? See our guide to email attachment size limits.