Redact a bank statement before you share it, and keep what they need

Redact PDFRemoves content, not just a black box. Free, runs on your device.Open

What the requester actually needs

A statement is asked for as proof of something, and that something decides what stays:

• A landlord or letting agent wants to see that rent-sized income arrives regularly and that you have a buffer.
• A visa or immigration office usually wants proof of funds: your name, the account, the period and the balance, sometimes over several months.
• A lender wants income, regular outgoings and signs of other debts, so it may refuse a statement with much blacked out.

None of them needs your card number, the name of the friend you sent money to, or the pharmacy you paid on the 5th. Everything that proves the point stays; everything else is yours.

The 8 fields to redact, and the 4 to keep

The 8 fields, with why each matters:

1. Card numbers. A full card number on a statement is rare but happens in refunds and card payment lines. Black it out wherever it appears.
2. Your IBAN or account number, where the requester allows it. Many accept it with all but the last 4 digits removed; a lender who pays out to that account will want it whole.
3. Your customer or contract number. It identifies you at the bank and is no use to anyone else.
4. Payees’ names. The person you pay rent to or send money to has not agreed to appear in your visa file.
5. Payees’ account numbers, for the same reason.
6. Payment references and notes. “Loan repayment”, “court fine” or an invoice number can say more than the amount.
7. Purchases that reveal health, faith, politics or union membership: a pharmacy, a clinic, a parish, a party or a union. These are the “special categories” that the EU’s GDPR, Article 9, protects most strictly (checked on 11 October 2026). Black out the description and, if the requester accepts it, the line.
8. Other accounts the statement shows, such as a savings pocket or a credit card summary, unless they are part of what you are proving.

Keep your name and address, the bank’s name and the statement period, the income lines, and the opening and closing balances. On a proof of funds, those are the evidence.

Step 1: ask before you redact

One email saves a resubmission. Write to the person who asked for the statement: “Is a statement with card numbers and individual purchases blacked out acceptable?” Visa offices and lenders that check statements against the bank, or check the bank’s digital signature, may want the original download. If they do, ask your bank whether it can issue a balance confirmation or a shorter extract instead.

Step 2: redact the statement

1. Open the statement at /redact-pdf. It opens in your browser tab, with the Redact tool picked. Nothing is uploaded.
2. Click Find personal data. It reads every page and lists what it finds by kind: Email addresses, Phone numbers, Bank accounts (IBAN), Card numbers, Dates and more.
3. Untick what must stay, then click the Mark button (it says how many, as in Mark 9 for redaction).
4. Drag boxes over the rest by hand: payees’ names, references, sensitive purchases, the customer number.
5. Check every page’s header and footer. Statements repeat the account number at the top of each page; the finder catches an IBAN on every page, but a plain account number or customer number only by hand.
6. Click Save. The status line says what was taken out, and the file is saved as -redacted.

What the finder found on our test statement

We made an invented 2-page statement for Jane Cooper, typed like a bank’s PDF export, and ran Find personal data on it (11 October 2026):

On the statement	Listed as	Right?
Her IBAN, in the header of both pages	Bank accounts (IBAN), 2 hits	yes
The landlord’s IBAN in the rent line	Bank accounts (IBAN)	yes
A full card number in a card payment	Card numbers	yes
Her email and mobile number, the bank’s help address and hotline	Email addresses, Phone numbers	yes
10 dates, 9 written like 01.09.2026 and 1 as “1 October 2026”	Dates (unticked at the start)	yes
Part of a payment reference (“0912 4471”)	Phone numbers	no: untick it
Her name and street address, the landlord’s name	not found	mark by hand
Customer number, a masked card number (**** 1111)	not found	mark by hand if needed

With everything except Dates ticked (the reference included), saving took out 188 characters from 9 areas in a fraction of a second. The lesson is the same as for any rule-based finder: it saves you hunting for the long numbers, and you read the list before you click Mark.

If your statement is a scan or a photo, run OCR PDF on it first. The finder then reads the recognised text and boxes each hit at the height of the printed line, so the save paints the printed numbers out of the picture. On a scanned copy of page 1 it listed both IBANs, the card number, the email and the mobile number. Check each box before you save, since a digit OCR misread is not found; Redact a scanned PDF has the details.

Step 3: clear the file’s own details

The bank’s export carries its own metadata: it can hold a title with your name or account number, the bank’s software and the creation date. Redaction does not touch it. Drop the -redacted file on Remove PDF metadata and click Remove metadata: it removes the document properties and the XMP packet, and saves the result as -clean.

Then rename the file. “statement-redacted-clean.pdf” says nothing; “jane-cooper-iban-3201-statement.pdf” says too much.

Step 4: check before you send

1. Open the final file, select all, copy, and paste into a text editor. Search for the last 4 digits of the card and for each payee’s name.
2. Drop it on Inspect: the Metadata and XMP metadata panels should say none, and the Security panel lists Attachments and Digital signatures.
3. Read it as the requester will: is the income still visible, is the balance still there?

The honest part

• Redact around the evidence, never the evidence. A proof of funds with the balance blacked out proves nothing, and a statement with every line blacked out invites the question of what is being hidden.
• Some requesters refuse any redacted statement, and they are entitled to set their own rules. This page explains the method, not the law; if you are unsure what you must disclose, ask the requester or an adviser.
• A signed statement loses its signature when redacted. Inspect tells you whether the file is digitally signed before you start.
• The finder is rules, not judgement. It does not know that a pharmacy line is sensitive or that the bank’s own hotline number is harmless. You decide.
• Once the file is ready, sending it is the last risk. Send a confidential PDF by email compares the ways to do it.