The short answer
The password depends on how you got the statement.
| Statement | Password | Status |
|---|---|---|
E-statement requested by SMS (ESTMT) | The 4-digit code you chose in the SMS | Published by SBI |
| Statement emailed by SBI, including one sent after a call to customer care | Last 5 digits of your registered mobile number, then your date of birth as DDMMYY | Reported by account holders |
| Statement or certificate downloaded from YONO or OnlineSBI | The rule shown on the download screen. Reported: first five characters of your first name in capitals plus DDMMYYYY, or the mobile format above | Reported by account holders |
Need it in Excel? Drop the locked PDF above, enter the password, and DocFig unlocks and converts it in one step.
What SBI publishes
On its missed call and SMS banking page, SBI says an e-statement for the last six months can be requested by SMS: "Send an SMS 'ESTMT <space> <Account Number> <space> <code>' to 917208933145 (Note: Code is any 4 digit number of your choice which will be used to encrypt the PDF attachment sent to your registered email address)". So for that statement, the password is the code you typed.
Source: SBI Quick missed call banking, checked 13 October 2026.
What account holders report for other SBI statements
SBI does not publish the password for emailed, YONO or OnlineSBI statements on its website. The formats below are the ones account holders report, and they are not official. Try them in this order.
- Last 5 digits of your registered mobile number, then your date of birth as DDMMYY. Reported for statements emailed by SBI and, in 2026, for many YONO and OnlineSBI downloads. Example: mobile ending 54321, born 7 March 1990, gives
54321070390. - First five characters of your first name in capitals, then your date of birth as DDMMYYYY. Account holders quote this as the instruction shown on some YONO download screens and on interest certificates: "The Password will be the first five characters of your first name (upper case) followed by your Date of Birth in DDMMYYYY format." Example: RAHUL, born 7 March 1990, gives
RAHUL07031990.
Account holders also report these details for the name format:
- If your first name has fewer than five letters, several report that it must be padded with spaces to five characters: DEV becomes
DEVfollowed by two spaces, then the date. - The name is read from SBI's records, so an initial or a space in the registered name counts as a character.
- If neither format works, check the date of birth SBI holds for you. One account holder found a different birth date in SBI's records.
Sources: account holders in the r/personalfinanceindia thread "Sbi account statement password issue" (posts from April to September 2026, one quoting the YONO instruction), and CreditMantri for the emailed statement format. Checked 13 October 2026. Examples use fictional names and numbers.
If the statement still will not open
- Read the download screen or the email again. When SBI shows a password rule there, it is the one that applies to that file.
- Use the mobile number registered with SBI, not a newer number you have not updated with the bank.
- Mind the year: two digits in the mobile format (DDMMYY), four digits in the name format (DDMMYYYY).
- Ask customer care to email the statement again. Account holders report that statements sent this way use the mobile number format.
- After ten wrong tries on the same file, DocFig pauses that file for an hour to stop guessing.
Convert the SBI statement to Excel or CSV
Once the password opens the file, DocFig reads every transaction into a spreadsheet: date, description, money out, money in and balance, with UPI, NEFT and IMPS references kept in the description. Each row is checked against the balances printed on the statement, and any row that does not add up is highlighted with the reason. Download an Excel workbook with real dates and numbers, or a UTF-8 CSV for import into accounting or budgeting software. See bank statement to Excel for the workbook details.
What happens to your password and statement
The password you type is sent over HTTPS with the file and used once, in memory, to open the PDF. DocFig does not guess or try passwords for you; it uses only the one you enter. The password is never stored, logged or sent to the AI model, and nothing from the statement is kept after the rows reach your browser. Account numbers are masked before any text leaves the server. Every step is on the Security page.
For other banks, see bank statement password.
DocFig is not affiliated with or endorsed by State Bank of India. State Bank of India and related names are trademarks of their owner, used here only to describe compatibility.