How to Redact Sensitive Information from a PDF Properly

Redacting a PDF is one of those tasks that looks easy and goes wrong in spectacular ways. Drawing a black rectangle over a name in Acrobat or Preview hides the name visually but leaves the original text in the document, recoverable in seconds by anyone with a free PDF reader. High-profile leaks at the United Nations, the U.S. Department of Justice, and Manafort's legal team have all involved precisely this mistake. Proper redaction permanently removes the text from the document, which is harder than it sounds and benefits from a tool built for the purpose.

A short history of failed PDF redaction

PDF redaction failures have been a recurring news story for over twenty years. In May 2005, the U.S. military published a report on the killing of Italian journalist Nicola Calipari in Iraq with sensitive sections "redacted" by black overlays; Italian journalists who downloaded the PDF were able to select and copy the underlying text within minutes. In 2009, the U.S. Department of Justice released a memo on enhanced interrogation with the same flaw. In 2019, Paul Manafort's legal team filed a court document with bracketed black redactions that turned out to be transparent boxes, exposing details of his contacts with Konstantin Kilimnik. The same year, a confidential Boeing FAA filing about the 737 MAX MCAS system reached reporters in fully readable form because the redactions were just shapes.

The pattern is so consistent that the NSA published the guidance "Redacting with Confidence: How to Safely Publish Sanitized Reports Converted from Word to PDF" in late 2005, and Adobe and Foxit both shipped dedicated redaction modes in the years that followed. The core lesson: a redaction tool must delete the underlying text and replace it with an opaque mark; visually covering with a rectangle is never sufficient.

Why visually covering text fails

A PDF stores a page as a content stream: a sequence of drawing operators that place text, lines, rectangles, and images on the page. When you draw a black rectangle over a name in Acrobat, the PDF now contains both the text operator (writing the name) and the rectangle operator (drawing the box over it). The viewer renders both, in order, producing a page where the name is hidden visually. The text operator is still in the file, indexable, copyable, and recoverable by any PDF parser. Adobe's own Reader will let you select the hidden text with Ctrl+A and paste it into Notepad.

Form fields, comments, and metadata are stored in entirely separate dictionaries in the PDF and are not affected by visual overlays at all. A "redacted" PDF that still has the author's name in metadata, comments referencing the redacted text by name, or form field values containing the original data is just as leaky as one with text under a rectangle.

How a proper redaction tool works

A real redaction does three things:

1. Removes the text content from the content stream at the redacted regions, so any future parser sees the redaction mark, not the original text.
2. Removes any metadata that referenced the original content, including the document author, last editor, software, original filename, and any custom XMP metadata fields.
3. Removes form fields, comments, and attachments that overlap or reference the redacted regions.
4. Replaces the area with an opaque mark (usually a black rectangle, sometimes with a redaction reason like "[FOIA exemption b6]") drawn on top of the now-empty content.

Browser-based redaction tools using pdf-lib or PDF.js can do all of this in JavaScript without uploading the file. The redacted PDF is rebuilt locally and offered as a download. Because the original never leaves your device, the privacy guarantee is total.

How to redact a PDF, step by step

1. Upload the PDF. Drop the file onto the page. The tool reads it into memory and shows the first page for preview. Nothing is uploaded.
2. Find what to redact. Use the text search to find names, account numbers, dates of birth, addresses, or any other recurring sensitive string. The tool highlights every occurrence.
3. Mark redaction regions. Click and drag to draw a rectangle, or click "redact all matches" to apply the mark to every found instance at once.
4. Optionally add a reason label. Government workflows (FOIA, GDPR Article 17, HIPAA) often require the redaction to be labelled with the legal basis. Type the label and it is drawn inside the rectangle.
5. Apply the redaction. This is the key step: it permanently deletes the text under the rectangles from the content stream, strips metadata, and saves a new PDF with the marks burned in.
6. Verify the result. Open the redacted PDF, try Ctrl+A then Ctrl+C and paste into a text editor. You should see the redaction labels (or nothing) where the original text was, never the original text itself.

What to redact

The obvious cases are names, addresses, phone numbers, email addresses, and account numbers. The less obvious ones cause most of the real-world leaks:

The last row is especially important: a screenshot of a CRM showing a customer record, embedded in the PDF as a raster image, will not be redacted by text-layer tools. The image itself must be painted over.

Common pitfalls

• Black-boxing in Word and re-exporting to PDF. The text under the box is still in the Word document and survives the export. Even if your visible page looks clean, the PDF content stream contains the original.
• Using highlight + change colour to black. The highlight is a comment annotation, not a content stream change. Anyone can remove the annotation to reveal the original.
• Forgetting metadata. A redacted memo with "Author: John Smith" in the document properties tells you who wrote it, even if every name in the body is redacted.
• Forgetting comments. Adobe and PDFelement reviewers often add comments referencing names that are being redacted in the body. Strip all comments.
• Forgetting form field history. Filled PDF forms can carry the values of previous form submissions in their AcroForm dictionary. Flattening removes the field, but the value may still be in document history.
• Not redacting images of text. OCR the document, identify the text bounding boxes, then paint over those regions in the image itself, not just the OCR text layer.
• Confusing print-to-PDF with redaction. Printing to PDF rasterises the page, which does remove the text layer, but produces a much larger file and loses searchability. It is a heavy-handed workaround, not a redaction.
• Sharing the original by mistake. Always rename the redacted file with a clear suffix (-redacted.pdf) so you cannot accidentally attach the original.
• Trusting visual review alone. The redacted PDF may look perfect and still leak. Always test by selecting all text and copying, by extracting metadata with pdfinfo or exiftool, and by checking the file size against the original.
• Permission-based "redaction". Locking a PDF with a password or restricting copy is not redaction. The data is still in the file and the restrictions are advisory; PDF password removers are a click away.

Alternative tools and workflows

For a one-off legal filing or job application, the browser tool is the right answer. For batch redaction of hundreds of FOIA requests, Acrobat Pro or a scripted qpdf + pdftotext pipeline pays for itself. For redacting image-heavy scans, run OCR first and then redact the bounding boxes in both the OCR text layer and the underlying raster.

Verification checklist before sharing

Before you send a redacted PDF outside your team, run through this checklist:

• Select all text (Ctrl+A) and copy into a text editor. The redacted strings should not appear.
• Open metadata: exiftool file.pdf or use a PDF viewer's properties dialog. Author, creator, last editor, original filename, custom XMP fields should all be empty or anonymous.
• Check comments and annotations explicitly. Acrobat's comment panel, Preview's annotation list, or pdftotext -layout will all surface them.
• Confirm the file size is materially smaller than the original (removed text and metadata should reduce size). A redacted PDF that is the same byte size as the original is suspicious.
• For documents with images: open in an image viewer and zoom in on the redacted areas. Some viewers reveal image content under overlays.
• For multi-page documents: spot-check at least the first, last, and three random middle pages. Search for the redacted names again to be sure no occurrence was missed.

Privacy and the redactor

The browser PDF redactor runs entirely in your device's memory. The file you drop is read by the File API, parsed by pdf-lib or PDF.js in JavaScript, re-rendered with the redactions applied, and offered back as a download. Nothing is uploaded, nothing is logged, nothing is cached server-side. For sensitive material (court filings, medical records, FOIA responses, breach notifications), that local-only flow is the difference between a redaction you control and a redaction you have to trust someone else to handle correctly. The whole tool can run offline once the page is loaded, which you can verify by disconnecting your network and redacting another file.