Calm Code

Automating My Payslip Workflow

This used to be my manual steps to handle filing my payslip.

  1. Open the mail
  2. Save the PDF
  3. Open the password manager
  4. Copy the password for the payslip
  5. Open the PDF
  6. Paste the password
  7. Export the PDF as unencrypted
  8. Rename and move the file to the payslips folder

To cut down some time I used Hazel to rename and move the file (step 8) when I saved it. I still had the issue of unlocking the PDF.

I found a tool called qpdf that can remove the password from the PDF. So I installed that and managed to decrypted the file like this.

brew install qpdf
echo "<payslip password>" | qpdf payslip.pdf --decrypt \
--password-file=- --replace-input

Unlock PDF

That saved me a bunch of steps but I didn't want to use the password in plain text. So I used another tool called pass to store and fetch it when I needed it.

brew install pass
pass insert Company/Payslip
pass Company/Payslip | qpdf payslip.pdf --decrypt \
--password-file=- --replace-input

Get password from a store

I took that command and added it to Hazel.

The Hazel Workflow

The unlock script looks like this

    pass Company/Payslip | qpdf "$1" --decrypt --password-file=- \
    --replace-input

Hazel script

Hazel replaces the "$1" with the file name. So I only have to save the file and off it goes.

**Update:**pass doesn't work in this script unless you are logged into the password store. Since this is another manual step I have in-lined the password for now. Please note this is not secure. You should at least move the password to an external file.

echo "<password>" | qpdf "$1" --decrypt --password-file=- --replace-input

The password store setup was a bit more complex so I have skipped that part here. We can take this further and automate fetching the payslip from my email account, but that's for another day.

  1. Hazel – Noodlesoft – Simply Useful Software
  2. Pass: The Standard Unix Password Manager
  3. QPDF: A Content-Preserving PDF Transformation System