Redact a PDF properly: remove the text, never just cover it

Redact PDFRemoves content, not just a black box. Free, runs on your device.Open

Why a black box is not redaction

A PDF page is a list of drawing instructions: write these characters here, paint this picture there, fill this rectangle. A black rectangle drawn with a shape tool, a highlighter set to black or a comment box is one more instruction added at the end. It paints over the words on screen and on paper. The words themselves are still in the page.

We tested it on our invoice test file, whose total line reads “Invoice total: 1,190.00 EUR”. With a filled black rectangle drawn over the amount and the file saved, the page showed solid black where the amount was. Text extraction still returned “1,190.00”, exactly as before.

That is the whole trick behind the redaction failures that made the news: a court filing or a government report goes out with black boxes, someone selects the black, copies, pastes, and the hidden text appears.

What true redaction removes

When you save in getPDF’s editor with areas marked, the engine goes through each page with a box on it and takes out:

• Text, character by character. Only the characters under the box go. The rest of the line is written again as real text in the same font, size and colour, so it still selects and searches. On the invoice, 9 characters went (the amount and the space a hand-drawn box takes with it), and the line now reads “Invoice total: EUR”.
• Picture pixels. The covered part of a photo or scan is painted black in the picture itself, and the picture is written again, so the original pixels are not in the file. A picture that lies wholly inside a box is removed.
• Drawings. Lines are cut where they cross the box, so a table keeps its borders outside it; curves and small shapes (such as letters drawn as outlines) that cross it go.
• Links, notes and form fields under a box go, and a field’s typed value is cleared first.
• Invisible text, such as the text layer OCR adds to a scan, goes the same way as visible text.

Then each box is drawn black, and the file is written in full. No earlier version of the page stays inside it. Our engine tests decompress every stream of the saved file and search it for the removed text, and the same search finds it in the original. On the invoice, “1,190” appeared nowhere in the 2,333-byte result.

How to redact a PDF, step by step

1. Open the file at /redact-pdf. The editor opens with the Redact tool picked (press R if you switch tools). Nothing is uploaded: the file opens in your browser tab.
2. Let the finder do the first pass, if the document has personal data in it. Click Find personal data in the bar. It lists emails, phone numbers, bank accounts (IBAN), card numbers, US Social Security, UK National Insurance and EU VAT numbers, and dates, page by page, in the text and in filled form fields. Tick what should go and click the Mark button, which counts your ticks (Mark 5 for redaction). Dates start unticked. Read the list before you mark: rules make false hits, and it does not find names or street addresses.
3. Drag a box over everything else that must go: names, addresses, a signature, a photo, a paragraph. The bar counts the areas marked.
4. Check every page, including headers and footers that repeat an account number or a name on each page.
5. Click Save. The status line reports what was taken out, for example “Saved with 1 area redacted: 9 characters taken out”. The new file is named after the original with -redacted on the end.

Until you save, every box is a mark: select it and click Unmark, or undo. The open copy keeps everything under the marks until you close it; only the saved file has it removed.

Check the result yourself, in 2 minutes

Do not trust any tool’s promise, ours included. Check the file you are about to send:

1. Select all and paste. Open the -redacted file in your usual viewer (Acrobat, Edge, Chrome, Preview), press Ctrl+A (Cmd+A on a Mac), copy, and paste into Notepad or TextEdit. Search for each thing you removed.
2. Extract the text. Drop the file on PDF to Text and search the result. This reads every character on every page, including invisible text a viewer will not let you select.
3. Inspect what is outside the pages. Drop it on Inspect and read the Metadata, XMP metadata and Outline (bookmarks) panels and the Attachments row. Redaction does not touch those.

What redaction does not touch

Redaction works on what is under the boxes. In our test, a file with an author name, a title, 4 bookmarks, an XMP packet and an attached spreadsheet came out of a redaction with all of them still there. The editor says so when you select a redaction mark: “The file’s title, bookmarks and attachments are not changed”.

So the full job is 2 or 3 steps:

• Run Remove PDF metadata on the redacted file for the title, author, dates and the XMP packet.
• If a bookmark title or an attachment gives something away, Extract pages with “1-” as the pages writes a new file with every page and no bookmarks or attachments (measured: both gone).
• Rename the file. The -redacted name keeps the original file name in front of it.

Clean a PDF before publishing puts these in order.

The honest part

Redaction is visible by design. A reader sees black boxes and knows something was there, and sometimes how long it was. If nobody may know that a passage existed, redaction is the wrong tool: edit the source document, or edit the PDF, so the passage is not there at all.

A few more limits, plainly:

• The finder reads text. On a scanned page without OCR it finds nothing. After OCR PDF it reads the text layer and boxes each hit at the height of the printed line, so the printed digits go too; look at each box before saving, because a digit OCR misread is not found. Redact a scanned PDF has the measurements.
• A digitally signed file loses its signature. A redaction writes the file anew, so the signature no longer covers it.
• A redacted picture is written again as a JPEG at quality 90 when it was a JPEG, so a redacted scan grows a little: 34.8 KB became 45.3 KB on our 1-page lease scan.
• While you work, a recovery copy of the document, with nothing redacted, stays in this browser’s storage so a crash does not lose your marks. It never leaves the device, and closing the file deletes it.
• Context survives. A box over a name does not help if the next sentence says “the tenant of flat 4 since 2019”. Read the redacted copy as a stranger would.