My statement is password-protected. Which password does it want?
Consolidated statements arrive as locked PDFs. Here is what the password usually is, and what Vestora does with it once you type it.
Updated 20 Aug 2026
Which password
Registrars and depositories send consolidated statements as password-protected PDFs, and the password is set by whoever sent it — not by Vestora. For most Indian investors it is your PAN in capital letters. Some senders use your date of birth, or a mix of the two.
The covering email that delivered the statement almost always says which one it is, in the body just above or below the attachment. That email is the authority — if it disagrees with anything here, believe the email.
What Vestora does with it
You type the password once, when the file is opened for reading. Vestora can remember it so you do not have to type it again for the next statement from the same sender.
Where a remembered password is stored depends on which version you use. On the computer version it is stored on your own machine: if you have set an app-lock passphrase it is encrypted with that passphrase, and if you have not, it is stored as ordinary text — and the app tells you so at the moment you choose. On the cloud version it is stored with your account under the same protection as the rest of your data.
The password is used to open the document and nothing else. It is never part of a statement's contents, and it is not needed to read numbers you have already imported.
If the password is refused
Check for spaces at either end, and check the capitals — a PAN password is normally all upper case. If it still will not open, open the same file in an ordinary PDF reader and type the password there. If the PDF reader refuses it too, the problem is the password rather than Vestora, and the sender can reissue the statement.