How to Redact a PDF Properly (Not Just Cover It Up)
Covering text with a black box does not remove it. The text is still in the file, still selectable, still copyable, and still readable by anyone who knows to look. Real redaction removes the content. The difference has caused some genuinely serious leaks, and it is worth ten minutes to get right.
Why covering text does not work
A PDF stores text separately from anything you draw on top of it. A black rectangle is a new object placed over the page — it changes what you see, not what is there.
The hidden text can be revealed in several easy ways. Select the whole page and copy, then paste into a text editor: the covered words appear. Search for a term you know is under a box: the reader finds it. Open the file in a different tool that ignores the overlay: the text is visible again.
There is a documented history of exactly this happening in court filings, public records and corporate disclosures. The pattern is always the same: somebody drew boxes, believed the job was done, and published the file.
What real redaction does
Proper redaction removes the underlying content and replaces it with an opaque block, so there is nothing left to extract. After it, the page genuinely contains only the block — no hidden text, no recoverable image underneath, no metadata pointing at what was removed.
Some tools go further and also strip metadata, embedded thumbnails, annotations and document properties, any of which can leak information. If you are redacting because the file is about to become public, those are worth clearing too.
How to redact a PDF
- Open the Redact PDF tool and add the document.
- Work through the pages and identify everything that must go: names, identity numbers, account numbers, addresses, signatures, photographs, and any figure that identifies a person or an amount.
- Drag a box over each area. Make the box slightly larger than the text you are covering — a redaction that leaves half a character visible is a redaction that failed.
- Be thorough about the obvious identifiers. A document with the name removed but the address intact has not been anonymised.
- Check the whole document once more for anything you missed, including headers, footers, page numbers that reference a case ID, and signature blocks.
- Apply the redaction and save. Open the result, select the whole page, and copy it into a text editor — the redacted text should not appear.
The places people forget
- Document properties. Author, company, and sometimes the original file path are stored in the file itself, and are readable without opening it.
- File name. "Redacted-complaint-Smith-v-Jones.pdf" defeats the purpose of the redaction.
- Headers and footers, which often carry a name, an account number or a case reference on every page.
- Embedded images. A scanned signature or a photograph of a person is an image, so it needs to be covered, not just typed over.
- Annotations and comments. Review notes frequently contain exactly the information the document is being redacted to hide.
- Hidden layers and optional content, which some PDFs use for print-versus-screen versions. Content hidden in a non-printing layer is still in the file.
Redaction versus the alternatives
- Use redaction when the recipient needs to read the document but must not see certain details — a contract shared with a third party, a case file released publicly, a report with personal data removed.
- Use a password instead when the whole document is confidential and only certain people should read it. Redaction is for partial disclosure; passwords are for restricted distribution.
- Use white space when the document will be printed and never shared electronically. Covering text with a white box is fine on paper, and nowhere else.
- Use deletion when the information should not be in the document at all. If a page exists only to carry sensitive content, removing the page is cleaner than covering part of it.
Check your own work
- Select all the text on a redacted page, copy it, and paste into a plain text editor. Nothing you redacted should appear.
- Search the document for a distinctive term you removed. The search should find nothing.
- Open the document properties and check the author, title and subject fields.
- Look at the file name one last time before sending.
- If the document is going to a wide audience, ask somebody else to look at it for a minute. A second pair of eyes catches what familiarity hides.
Why doing it locally matters here more than usual
Redaction is applied to the documents where an accidental disclosure is most damaging — and uploading them to a redaction service means the unredacted original now exists on somebody else's server. That is a larger exposure than the one you were fixing.
A browser-based redaction tool removes the content on your own device. The unredacted file never leaves it, and the exported version is the only copy that exists outside your control.