How to send tax documents securely: 4 methods, ranked

A tax return is the most complete identity kit you own. One folder holds your name, address, Social Security number, employer, income, bank account and, often, the same details for your spouse and children. Most people send that folder as a plain email attachment once a year.

How to send tax documents securely

Use your preparer's or lender's secure portal if they have one. If they don't, send the files by end-to-end encrypted email, or put them in a password-protected PDF and give the password over the phone. Never attach unprotected tax forms to an ordinary email, and never put the password in an email.

That is the short version. The rest of this guide ranks the four methods, gives the exact steps for each, and adds the one check that matters more than any encryption: making sure the person on the other end is who you think they are.

The four methods, ranked

A portal ranks first because nothing travels through anyone's inbox, so there is no attachment sitting in two Sent and Inbox folders for the next ten years. In-person delivery is very safe but slow, and it only works when the office is nearby. Ordinary email with a bare attachment is not on the list.

Is it safe to email tax documents to an accountant?

Not as a plain attachment. Standard email is usually encrypted only while it moves between mail servers. Once delivered, a readable copy sits in your Sent folder, in the recipient's inbox, and on both providers' servers. Anyone who later breaks into either account gets every return you ever sent.

The IRS treats email this way itself. Its page on sending documents electronically (updated June 2026) lets taxpayers email an IRS employee only during an open case such as an audit, and tells them to "be sure to encrypt any attached documents." It adds two details most guides skip: "Never send a password by email," and "Encrypted email does not encrypt the subject line."

The IRS tells tax professionals the same thing from the other direction. Publication 4557, its data security guide for preparers, says: "A legitimate business will never email and request personal or sensitive information be sent to them via email, unless through a secured mail service." If a preparer asks you to "just email it over," they are working against the IRS's own guidance.

If you want to see what protection an email you already sent actually had, the header check in our guide on how to tell if an email is encrypted takes about a minute.

Method 1: use the secure portal

Tax preparation firms, mortgage lenders and mortgage brokers are all covered by the FTC's Safeguards Rule. The FTC's summary of the rule requires them to "encrypt customer information on your system and when it's in transit" and to "implement multi-factor authentication for anyone accessing customer information." A client portal is how most firms meet that requirement, so ask for it even if nobody offered.

1. Ask the firm for its portal link by phone, or type the firm's web address yourself. Do not follow a portal link from an unexpected email.
2. Create your login with a password you use nowhere else, and turn on two-step verification if the portal offers it.
3. Upload PDFs or clear photos of each form. Name the files plainly, such as "2025 W-2 employer name," so nothing gets missed.
4. Check that the portal shows each upload as received, then tell the preparer by phone or message that the files are there.
5. After filing, download your finished return from the portal and store it somewhere encrypted.

Sending to the IRS itself works the same way. If you received a notice, the IRS Document Upload Tool takes scans and photos in JPG, PNG or PDF format and confirms receipt.

Method 2: send by end-to-end encrypted email

End-to-end encryption locks the message on your device and unlocks it only on the recipient's. Neither email provider holds a key, so a breach of either provider exposes nothing readable. This is the right method when there is no portal and you send documents to the same person every year.

1. Confirm that you and the recipient use a service or setup that encrypts end to end with each other. S/MIME, PGP and encrypted email services all qualify. Our walkthrough on how to send an encrypted email has the steps for Outlook, Gmail and Apple Mail, with who can still read the message under each option.
2. Write a subject line that says nothing. "Documents for our call" is fine. "2025 tax return, SSN attached" is not, because subject lines are often left outside the encryption.
3. Attach the files and send.
4. Ask the recipient to confirm they could open everything.

This is how Secria Mail works without any setup. A family or a small practice that uses Secria can pass tax files back and forth end-to-end encrypted, with no certificates and no passwords to exchange. Every message in your mailbox is stored with zero-access encryption, which matters for the copy that stays behind: keys are created on your device and only ever reach our servers encrypted.

Method 3: password-protect the PDF and phone in the password

This is the method to use when the other side only has ordinary email. It needs no account and no paid software. The file is encrypted before it leaves your computer, and the password travels by a different route.

On a Mac (Preview). Apple's Preview guide gives these steps:

1. Open the PDF in Preview and choose File > Export.
2. Click Permissions.
3. Select Require Password To Open Document, then enter and retype the password.
4. Enter an owner password as well, click Apply, then Save.

On Windows (Word). If the document is a Word file, or you can paste scans into one:

1. Choose File > Save As and set the file type to PDF.
2. Click Options.
3. Check Encrypt the document with a password, click OK, and set the password.

Then send it properly:

1. Combine everything into one PDF if you can, so there is one file and one password.
2. Use a password of at least twelve characters. That is the IRS's own minimum for encrypted attachments. A weak password can be guessed, because whoever holds the file can try as many times as they like.
3. Give the file a dull name. The file name and the email text are not encrypted.
4. Email the file. Keep your Social Security number, address and phone number out of the subject and the body.
5. Call the recipient on a number you already had and read them the password. A text message is an acceptable second choice. Sending it in a follow-up email defeats the point.

Method 4: hand it over or mail it

Dropping off paper at the office is the oldest method and still one of the safest. If you mail documents, send copies and keep the originals, use a service with tracking and a signature on delivery, and address the envelope to a named person. Ask the firm what happens to paper once it has been scanned.

Before you send anything: verify who is asking

Encryption protects the file on the way. It does nothing if the recipient is a criminal. Publication 4557 warns preparers that a thief "may pose as your tax software provider, your data storage provider, the IRS or even a prospective client," and that criminals "may hijack your email account to send spam emails under your name, tricking colleagues and clients into disclosing information." The same trick works on clients.

So when a message asks for documents, even from an address you recognize:

1. Do not reply to it and do not use any phone number or link inside it.
2. Call the firm on a number from an old invoice, a business card or its website.
3. Ask whether they sent the request and how they want the files delivered.

That call takes two minutes, and it is the step a hijacked email account cannot fake.

What to ask your preparer or lender

You are allowed to ask how your data will be handled. These five questions come straight from what the Safeguards Rule and Publication 4557 expect of the firm:

• Do you have a secure portal for uploads?
• Is my information encrypted where you store it, and when you send it?
• Do staff sign in with multi-factor authentication?
• How will you send my finished return back to me?
• When do you delete my records? The rule's default is "no later than two years after your most recent use of it to serve the customer," unless the firm has a legal or business reason to keep them longer.

A firm that answers easily has done the work. One that says "just email it" has told you something too.

Clean up after you file

Sending safely is half the job. The copies you leave behind are the other half.

• Delete the message from your Sent folder, then empty the trash. In Gmail, deleted mail stays recoverable for up to 30 days unless you choose "Empty Trash now."
• Delete the photos of your forms from your phone's camera roll and its "recently deleted" album.
• Keep one copy of the final return in encrypted storage, not in an open inbox.
• Get an IRS Identity Protection PIN. It is a six-digit number that "prevents someone else from filing a tax return using your Social Security number," it is open to anyone who can verify their identity, and a new one is issued each year.

If the thing you need to send is a single number and not a folder of forms, the answer is different. See is it safe to email your Social Security number?

FAQ

What is the safest way to send tax documents electronically? A secure client portal run by the preparer or lender, reached by typing the firm's address yourself. Nothing passes through an inbox, and firms covered by the FTC Safeguards Rule must encrypt customer information in transit. End-to-end encrypted email is the next best choice.

Is it safe to send tax documents through Gmail? Not as a plain attachment. The trip between servers is usually encrypted, but readable copies stay in your Sent folder and the recipient's inbox, and Google holds the keys to yours. If Gmail is your only option, encrypt the PDF first and give the password by phone.

Can I text a photo of my W-2 to my accountant? Avoid it. Standard text messages are not end-to-end encrypted, and the photo stays in both phones' message history and backups. An end-to-end encrypted messaging app is better than a text, and a portal is better than both.

Is a password-protected PDF secure enough for a tax return? Yes, when the password is at least twelve characters and travels by phone, not email. The IRS accepts password-encrypted PDF, Word and Excel attachments from taxpayers on those terms. The file name, subject line and message text stay visible, so keep them bland.

How do I send documents to the IRS securely? If you received a notice or letter, use the IRS Document Upload Tool. Email is allowed only with an IRS employee who is already working your case, with encrypted attachments and the password given by phone.

Tax season comes every year, and so does the folder. If you would like the inbox it lands in to be sealed by default, you can start with Secria for free.