How to redact a PDF so the text is actually gone
Redaction failures are a genre: court filings where highlighting the "black bars" reveals the names, government reports where copy-paste recovers the classified paragraph, corporate documents where the metadata names the author who was supposed to be anonymous. Every one of them comes from the same misunderstanding of what a PDF is. This guide explains it and gives the two methods that work, including the on-device redaction tool.
How redactions fail
The classic failure: someone opens the PDF in an editor, draws a filled black rectangle over the sensitive text, saves, and sends. It looks redacted. It isn't. The text is still an object in the file, drawn underneath the rectangle; select-all and paste into a text editor, or a search, or a screen reader, and it's all there. Variants include changing the text colour to black on a black highlight, "hiding" a layer, or cropping the page view — the page's content box is unchanged and the cropped area still exists. Any redaction that is a visual change rather than a content change fails this way.
Why a black box hides nothing
As How PDF files work: why some have text and some are pictures explains, a PDF page is a list of drawing instructions executed in order: the text is drawn, then the rectangle is drawn on top. Software that reads the page (search, extraction, accessibility tools) reads the instructions, not the rendered pixels — and the text instruction is still there. The same is true of images placed over images. Only removing or destroying the underlying instruction removes the content.
Methods that actually work
True redaction tools (Acrobat Pro's Redact, some paid alternatives) find the marked text and image regions, delete those objects from the content stream, replace them with a box, and rewrite the file — the professional standard, expensive and desktop-only.
Rasterising is the simple, robust alternative: render every page to an image with the black boxes painted in, and build a new PDF from those images. The new file contains no text objects at all, so nothing under a box can be recovered — the approach the browser tool takes. The costs are honest: the result isn't searchable (add an OCR layer afterwards with the searchable PDF tool if needed), it's larger, and it looks like a scan. For most redaction jobs that is exactly right, and it beats a false sense of security.
Printing and rescanning is the same idea done physically; it also works, and it's how a lot of legal offices still do it.
Metadata, attachments and the other leaks
Content isn't the only leak. PDFs carry metadata — author, company, creation and modification dates, the software used, sometimes the original filename and a document history — which has unmasked "anonymous" authors more than once. Attachments, embedded files, comments and annotations, form-field values and bookmarks can all contain what you thought you'd removed. Rasterising drops all of it; a true-redaction workflow should be followed by a "sanitise" or "remove hidden information" step. The metadata tool shows and clears the document properties; What your photos reveal about you covers the same problem in images.
A redaction checklist
- Work on a copy; keep the original somewhere safe.
- Redact by removing content (true redaction or rasterising), never by covering it.
- Check: open the result, select all, search for a redacted term. Nothing should be found.
- Strip metadata, comments, attachments and bookmarks.
- If the document must be searchable, OCR the redacted result — never the original.
- Do it on your own device. A document you are redacting is, by definition, one you shouldn't upload to a website.
Sources and further reading
The claims in this guide rest on these references, which were checked when the guide was last updated. Spotted an error? The contact page says how to report it.