A Form 16A password has no single rule. TRACES generates the certificate PDF with no password at all and the bank or company that emails it to you adds its lock, so the rule is printed in that email.
Three patterns cover most Form 16A files: the whole PAN in capitals, the first five PAN characters plus a DDMMYYYY birth date or the deductor TAN in capitals when a deductor forwards its own TRACES file.
A Form 16A lands in your inbox four times a year from every bank, company or tenant that deducted TDS on your interest, fees or rent. Each one arrives as a locked PDF and the password that opened the last one often fails on the next. That isn't a fault in your certificate. The Income Tax Department doesn't set a Form 16A password. The deductor does and each deductor picks its own rule.
Three Form 16A rules cover most cases, each sorted out here with the place to read the one that applies to your file and the way Univik PDF Unlocker turns a drawer of locked certificates into copies that open on a click.
What Is the Form 16A Password?
The Form 16A password is whatever the deductor chose when it emailed your certificate, because the file leaves TRACES with no password of its own. The TRACES PDF generation utility that deductors run turns the downloaded text file into one PDF per deductee and the Income Tax Department notes for that utility state that the individual PDF files carry no password. The only TAN-based lock in the official process sits on the text file your deductor downloads, which the TRACES e-tutorial says opens with the TAN in capitals.
The TRACES text file never reaches you.
I read the department notes on the TRACES PDF utility on 9 November 2026 before writing this, because most pages on the subject quote a single rule and that rule is wrong for half the certificates people receive. What reaches your inbox has passed through the deductor mail system and three habits dominate there.
| Who sent your Form 16A | Password rule that usually applies | Example |
|---|---|---|
| A bank, for TDS on deposit interest | Your PAN, ten characters in capitals | ABCDE1234F |
| A company, through a payroll or TDS vendor | First five PAN characters in capitals, then your date of birth as DDMMYYYY | ABCDE15081990 |
| A small deductor forwarding its TRACES download | The deductor TAN in capitals | DELA12345B |
The covering email names the rule in nearly every case. Read the line under your attachment before you type anything, because the deductor can also choose a value outside these three.
Why Does the Form 16A Come Locked?
A Form 16A prints your PAN, the deductor TAN, the amount paid to you and the tax deducted on it, quarter by quarter. Banks and companies send thousands of these certificates by email in the same fortnight, so they lock each PDF with a value only the right recipient should know. That lock is an open password, the kind that blocks the whole document until the value goes in. It is also why the rule changes from sender to sender.
Each deductor runs its own mail system and its own TDS software and each system has a default. The certificate itself, as TRACES produced it, was never locked.
How Do You Open a Form 16A PDF?
Open the email first and read the note beneath your attachment. Most banks write the rule there in one line. Then open the certificate in Acrobat Reader or Edge and enter the value exactly as described, with capitals where the note says capitals and no spaces anywhere. If the email gives no hint, try your PAN in capitals first, since banks favour it. Second, try five PAN characters and the birth date as DDMMYYYY. Try the deductor TAN third.
The TAN is printed on your Form 26AS and on any earlier certificate from the same deductor, so you don't need to ask for it. One of the three opens the great majority of Form 16A files.
How Do You Remove the Form 16A Password?
Four certificates a year from each deductor, each with its own rule, adds up fast for anyone with deposits in three banks and fees from two clients. Once a Form 16A has opened, Univik PDF Unlocker saves a copy that needs no password. Queue the certificates, give every file its own value in the Password column and press Check.
The status column shows which value was accepted and which certificate still waits for a different one, so a mixed folder where bank files take the PAN and company files take the PAN plus date can be worked through in one sitting. Unlock then drops those clean copies into your chosen folder, ready for your return or your accountant.
Univik PDF Unlocker takes a different value for every certificate, so bank and company Form 16A files with different rules clear in the same sitting.
Free Download See all featuresForm 16A Still Not Opening?
When none of the three values opens your certificate, go back to the email, because the deductor may have picked something else, like your PAN in lower case or your account number. Also check the case. A PAN in capitals and the same PAN in lower case are two different passwords to a PDF. Check the date too, since a payroll-style lock reads it as day, month and a four-digit year, zeros included.
If you hold two PANs from an old correction, the deductor may have used the one on its own records. A call to the deductor or a reissue request through the bank branch settles it. Do not confuse the Form 16A with your Form 16, which comes from your employer and usually follows the five characters plus date rule. An unlocker can't help with a Form 16A whose value you were never given, because its work begins after the certificate opens.
- TRACES issues the Form 16A PDF without a password. The deductor adds the lock when it emails the file.
- Banks mostly use the full PAN in capitals, companies often use five PAN characters plus your birth date as DDMMYYYY.
- A deductor that forwards its own TRACES file uses the TAN in capitals.
- The covering email names the rule. Read it before trying values.
- The unlocker tests each value per file, so a mixed folder of bank and company certificates can go through together.
- Form 16A is not Form 16. Your employer certificate follows its own page.
Form 16A Password Questions
Which password opens a Form 16A PDF?
The Form 16A password depends on your deductor, because TRACES issues the certificate PDF without a password and the sender adds one. Banks usually use your PAN in capitals. Companies often use your first five PAN characters plus your date of birth as DDMMYYYY. A deductor forwarding its TRACES file uses its TAN in capitals.
How do I open a Form 16A from my bank?
Type your PAN in capitals, ten characters with no space. If the bank note under your attachment names a different rule, follow that note instead.
Why does my Form 16A password differ from last quarter?
The deductor changed its TDS software or mail system or a different deductor sent this one. Each sender sets its own rule, so read your covering email for the current quarter.
Is the Form 16A password the same as the Form 16 password?
Not always. Form 16 comes from your employer and commonly takes your first five PAN characters plus your birth date. A Form 16A from a bank often takes the full PAN in capitals. Treat them as two separate rules.
How do I remove a password from several Form 16A files at once?
Queue them in Univik PDF Unlocker, give each certificate its own value, press Check against each and then Unlock. Every accepted certificate is written out without a password to your chosen folder.
Where do I find the deductor TAN if the file wants it?
The TAN is printed on your Form 26AS against each deductor and on any earlier Form 16A from the same sender. It is ten characters, four letters, five digits and a letter.
Is it safe to unlock a Form 16A on my computer?
Yes. A Form 16A carries your PAN and the income one deductor paid you, two things that should not pass through an upload site. Opening a certificate issued to you and saving it unlocked is an everyday filing step.
Leena Taylor Paul shaped this Form 16A guide at Univik, a Windows utility studio established in 2013. The point that TRACES issues the PDF without a password comes from the Income Tax Department notes on the TRACES PDF generation utility. Readers come with a locked certificate from a bank or a client, so the three common rules lead and the lasting fix closes the page. Verified November 2026. Still locked after all three? Contact our support team.