How to redact a PDF properly (and why black boxes leak)

A PDF is not a picture of a page. It is a bundle of objects: text runs with their fonts, images, vector shapes, annotations, form fields and, often, older versions of all of those. That structure is why so many "redacted" documents have leaked: the sensitive text was still in the file, just hidden under a rectangle. This guide explains what proper redaction has to do, how the Redact PDF tool does it in your browser, and how to check the result.

Why a black box is not a redaction

When you draw a filled rectangle over a name in most editors, you add a new object on top of the page. The original text object is untouched. Anyone can:

• select the "hidden" text and copy it, because the text run is still there;
• open the file in a viewer that lets you delete or hide annotations;
• search the file's bytes for the name, since fonts and text streams are still present;
• read it from the file's undo history if the editor used incremental saves, which append changes and keep every previous version inside the same file.

The same applies to images: a photo covered by a box is still embedded in full, and an image that was "cropped" in a viewer is often still stored uncropped.

Proper redaction therefore has three parts: remove the content from the page, rewrite the whole file so no old version survives, and verify the output.

What the Redact PDF tool actually does

The tool runs on your device: the PDF is parsed by PDFium compiled to WebAssembly inside your browser, and nothing is uploaded. When you press Apply and destroy content, this is the sequence for every page that carries a mark:

1. The page is rendered to a high-resolution raster (300 DPI by default; you can choose between 150 and 400) with the marked regions painted out.
2. Annotations and form values under the marks are blanked and removed, so nothing lives on in a comment or a field.
3. A new page is created that contains only that raster, and the original page, with all its text, fonts, images and vector art, is deleted from the document.
4. When you save, the document is written as a full rewrite rather than an incremental update. Because the PDF library can still emit objects that were created during the session, the file is written, reopened and written again, so only objects reachable from the final document survive.

The consequence is honest and worth knowing: a redacted page becomes an image. The remaining text on that page is no longer selectable. If you need it searchable again, tick Run OCR on redacted pages afterwards and the tool adds an invisible text layer, recognised locally, to the clean image. Pages without marks keep their text and vectors unchanged.

Verification before you download

Deleting content is not enough if you cannot prove it. When you export, the tool scans the finished bytes for every phrase that was under a mark. It looks for the literal text, its hexadecimal form, its UTF-16 encoding and inside inflated (decompressed) streams. If any match is found, the export is refused and you see a warning instead of a download. The same checks run in the project's automated test suite on every release, where redacted fixtures are reopened with two independent parsers (PDFium and PDF.js) and their bytes are searched.

Step by step

1. Open Redact PDF and choose your file. The Mark for redaction tool is active.
2. Drag rectangles over the text or images to remove. To catch every occurrence of a name or number, use Search, type the phrase and press Mark all search matches.
3. Open the Redaction panel to review the list of marked regions. Remove any mark you added by mistake.
4. Press Apply and destroy content. The tool warns you that the undo history will be cleared; redaction cannot be undone, so keep your original file.
5. Press Export. If the verification passes, the file downloads; if not, the export is refused.

How to check a redacted file yourself

Even with a tool you trust, a quick check takes a minute:

• Open the redacted PDF in any viewer and try to select text where the redaction is. Nothing should be selectable on a redacted page.
• Use the viewer's search for a redacted word. It should find nothing.
• Look at the file size. A page that has become an image is usually larger than a text page; a file that shrank dramatically after "redaction" may have simply lost an annotation.
• If you are comfortable with a terminal, search the raw bytes: grep -a "Smith" file.pdf on macOS or Linux. Compressed streams will not show up this way, which is exactly why the tool inflates them during its own check.

Common mistakes

• Redacting a scan by covering it. The scan is one big image; a box on top changes nothing underneath. You need the page rebuilt without that region, which is what the raster step does.
• Forgetting metadata and bookmarks. Names can also sit in the document title, author field or outline. Check Document info before you share.
• Sending the file with an incremental save. Some editors keep the old version in the same file. This tool always writes a full copy.
• Assuming the OCR layer is gone. If a scan was made searchable earlier, the hidden text layer must be removed too. The raster step removes it along with everything else under the mark.

Related

• Make a scan searchable before you redact it, so Mark all search matches can find the phrases: OCR PDF.
• Need to change text rather than remove it? Use Edit PDF.
• Only share some pages: Split PDF.