How to Redact a PDF Properly (and Why Black Boxes Usually Fail)

Every few months another organisation discovers that the document it published was not as redacted as it thought. The pattern is almost always identical: someone opened the PDF, drew black rectangles over the sensitive parts, saved it, and sent it out. The document looked perfect. The text underneath was still sitting in the file, and anyone who selected the page and pressed copy could read it.

This is not a rare failure or an exotic attack. It is the default outcome of the most obvious way to redact a document, and it catches careful people in law firms, government departments and finance teams. If you are about to send a contract, a statement, a case file or a records request response to someone outside your organisation, it is worth ten minutes to understand why.

Why the obvious method does not work

A PDF is not a picture of a page. It is a set of instructions describing what to draw: this text, in this font, at these coordinates; this image, scaled to this box. When you draw a black rectangle in most PDF editors, you are not deleting anything. You are adding one more instruction to the list, a filled black shape, positioned on top of the text.

The text instruction is still in the file, unchanged, underneath. Your PDF reader faithfully draws the text and then draws the black box over it, and your eyes see a redaction. But the words are still there in the document structure, and every one of these will bring them straight back:

• Selecting the area and copying it
• Running any text-extraction tool over the file
• Opening the PDF in a different reader that renders layers differently
• Simply moving or deleting the black shape in an editor

The redaction was never a redaction. It was a sticker.

What redaction actually has to mean

Proper redaction has one requirement, and it is absolute: the underlying content must no longer exist in the file you send. Not hidden, not covered, not moved off the visible page area. Gone.

There are two reliable ways to achieve that. The first is a dedicated redaction feature that deletes the text objects themselves and then draws the box, which professional PDF software offers and which requires care to apply correctly. The second is to flatten the page to an image and paint the boxes onto that image, so the only thing left in the file is a picture with black areas where the content used to be. There is no text layer left to leak, because there is no text layer at all.

The tool further down this page takes the second approach, and does so entirely inside your browser, which matters when the document is exactly the kind you should not be uploading to an unfamiliar website.

The four ways people leak data they thought they removed

1. Black boxes over live text

Covered above, and by far the most common. If your process was draw a rectangle, save, send, assume the content is readable.

2. Cropping instead of deleting

Cropping a page changes the visible boundary. It does not remove what falls outside it. A cropped PDF still carries the full page content, and resetting the crop box restores everything. Cropping is a layout tool, not a security control.

3. Metadata, comments and attachments

The visible page is only part of a PDF. Document properties can carry the author name, the originating file path and the software used. Review comments, tracked changes carried over from a Word export, form field values and embedded file attachments all live outside the page content you are looking at. A redaction that only addresses the visible text leaves all of it in place.

4. Sending the wrong file

Mundane and constant. The redacted version is saved alongside the original with a similar name, and the original gets attached. Put redacted copies in a separate folder and name them unmistakably before you go anywhere near an email client.

What US and UK rules actually require

Redaction is not only good practice, it is frequently a legal obligation, and the specifics differ by jurisdiction.

United States. In federal court filings, Rule 5.2 of the Federal Rules of Civil Procedure requires personal identifiers to be redacted before a document is filed. In broad terms that means Social Security and taxpayer identification numbers reduced to the last four digits, a minor's name reduced to initials, dates of birth reduced to the year, and financial account numbers reduced to the last four digits. Individual districts add their own local rules on top, and the obligation generally sits with the filing party rather than the court.

United Kingdom. Under UK GDPR and the Data Protection Act 2018, disclosing more personal data than necessary is a problem in itself. It comes up constantly when responding to a subject access request, where you must provide the requester's own data while removing information that identifies other people, and in Freedom of Information responses, where exempt material has to be removed before release. Data minimisation is a principle, not a formality, and an incomplete redaction is a personal data breach that may be reportable.

Whichever side of the Atlantic you are on, the standard is the same in practice: after redaction, the protected information must not be recoverable from the file. A black rectangle over live text does not meet that standard anywhere.

Before you redact: a short prep checklist

1. Work from a copy. Redaction that genuinely removes content cannot be undone. Keep the unredacted original somewhere safe, because you will eventually need to prove what was removed.
2. Search the document first. Use your reader's find function for the obvious patterns before you start marking anything, so you catch the account number that appears again on page 14.
3. Read the whole document, including the parts you think are boilerplate. Personal data hides in signature blocks, letterheads, footers, appendix tables and email chains pasted into the body.
4. Decide what is actually required. Over-redaction is its own failure, particularly in a subject access response, where removing the requester's own data defeats the point.
5. Check for a text layer. If the document is a scan, the visible text may not be selectable at all, but it may still have been through OCR at some point. Assume there is a text layer until you have confirmed otherwise.

What to look for, by document type

Most missed redactions are not subtle. They are the second occurrence of something you already removed once, sitting somewhere you did not think to read.

Contracts and agreements

Commercial terms are usually the reason for redacting, but the personal data is elsewhere. Check signature blocks for home addresses and personal email accounts, schedules and annexes for named individuals and their rates, and any execution pages where a witness has given their address. Contracts assembled from earlier deals frequently retain the previous counterparty's name in a definition or a cross-reference.

Bank and financial statements

Account numbers, sort codes and routing numbers, full card numbers, and the account holder's address in the letterhead. Remember that individual transaction lines can be identifying on their own: a payee name, a standing order to a named person, or a reference field containing a case number. If you are disclosing statements to prove one specific payment, consider extracting only the relevant pages first rather than redacting a hundred lines.

Medical and HR records

Names, dates of birth, patient and employee identifiers, and the names of third parties such as family members, colleagues who made complaints, or clinicians not relevant to the disclosure. Free-text notes are the highest-risk area, because identifying details appear in ordinary prose rather than in a labelled field, which means find-and-check will not catch them and you have to read.

Court exhibits and disclosure bundles

Apply the personal-identifier rules for your jurisdiction to every page, not only the pleading. Exhibits are where identifiers slip through, particularly scanned correspondence and screenshots. Where a bundle has been paginated, redact before numbering so the pagination on the disclosed version matches what the other side receives.

Documents that came from someone else

If you did not create the file, be more suspicious, not less. Anything exported from a template or a case management system may carry structured metadata describing matters and clients that has nothing to do with the visible page.

Redact your document now

The tool below runs entirely in your browser. Your file is never uploaded, which is the correct property for a document sensitive enough to need redacting in the first place. Drag a box over each area to remove, page by page, then apply.

When you apply the redaction, every page is flattened to an image and your black boxes are painted onto it. The output is a new document containing page images only, so the original text objects, and the metadata attached to them, do not travel with it.

Verify it worked, every time

Do not skip this. Verification takes thirty seconds and is the difference between believing a document is safe and knowing it.

1. Open the redacted file in a normal PDF reader.
2. Try to select the redacted area. Drag across a black box. Nothing should highlight, because there is no text there to select.
3. Search for a term you removed. Use find and type a name or number that was redacted. It must return no results.
4. Copy a whole page and paste it into a plain text editor. Anything that was genuinely removed cannot appear, and this catches content you missed elsewhere on the page.
5. Check the document properties for author, title and subject fields.

If any redacted content survives those five checks, do not send the file.

What this method costs you

Honesty about the trade-off matters, because there are cases where this is the wrong approach.

Flattening pages to images removes the text layer from the entire document, not only the redacted parts. The result is no longer searchable or copy-pasteable, and it will be larger than the original because photographs of pages compress less efficiently than text. Screen readers cannot read it, which is a real accessibility problem if the document is going to a public body or is intended for wide publication.

If the recipient requires a searchable document, the sequence is: redact first, then run OCR on the redacted file to build a fresh text layer from the flattened pages. That new layer is generated from what is visibly left, so it cannot reintroduce anything you removed. Do it in that order and never the reverse.

For a small number of pages inside a long report, consider extracting the affected pages, redacting only those, and merging them back so the rest of the document keeps its text layer.

Frequently asked questions

Can redacted content ever be recovered from a file redacted this way? Not from the page content. Flattening replaces the text objects with an image, and the black areas are painted into that image, so there are no hidden characters left behind. This is why the method is more robust than drawing shapes over live text.

Is a black highlight in a word processor enough before exporting to PDF? No. Black highlighting changes appearance only, and the text exports into the PDF exactly as it was. Setting the font colour to white is worse still, since the text remains selectable and copies out perfectly.

Does this remove the document metadata? The output is built as a new document from page images, so the original page-level text objects and their properties do not carry over. Always check the document properties of the final file yourself before sending it, as part of the verification checklist above.

Do I need to redact a scanned document? Yes, if it contains information that must not be disclosed. A scan has no text layer to copy, which stops casual extraction, but the information is still legible to anyone looking at it, and that is disclosure. Redact it the same way.

Is redacting a document the same as marking it confidential? No. A confidentiality marking is a signal about how a document should be handled. Redaction removes content. If you need both, apply the redaction first and add a watermark to the redacted output.

Related tools and guides

• Redact PDF, permanently remove content by flattening the page and painting over it
• OCR PDF, restore a searchable text layer after redacting
• Split PDF, pull out only the pages that need redacting
• Merge PDF, put redacted pages back into the full document
• Watermark PDF, mark the redacted copy so it is never confused with the original