How to Redact a PDF Properly Before You Share It
Covering sensitive text with a black rectangle looks like redaction and is not. The underlying characters are still in the file, still selectable, and still searchable — anyone can copy them out in seconds. Here is what actually removes information from a PDF, and the places people forget to check.
The black-box mistake
A filled rectangle drawn on top of text is a separate graphical object. The text underneath remains in the content stream, fully intact. Anyone can select it, copy it, or run text extraction and read it — the black box hides it from the eye, not from the file. There are well-documented cases of organisations circulating PDFs with "redacted" blocks that took seconds to defeat.
Real redaction removes the content: the characters are deleted from the page content stream and, ideally, the region is also flattened so nothing remains underneath.
Three ways redaction goes wrong
1. Only the visible layer is cleaned
PDFs can carry multiple layers, optional content groups and annotations that are hidden in normal viewing. A hidden annotation with a client name is invisible to you and readable to anyone who opens the layers panel.
2. Metadata is left intact
Document properties routinely contain the author's name, the creating application, edit history, and sometimes the original file path — which may include a client folder name. Document metadata is not visible on the page and is trivially readable in any viewer's properties dialog.
3. Attachments and embedded files are forgotten
A PDF can carry embedded file attachments, embedded fonts with licensing metadata, and multimedia annotations. A cleaned page with an untouched attachment is still a leak.
A practical checklist before sharing any sensitive PDF
- Identify what actually needs removing. Names, account numbers, addresses, signatures, internal references, and anything that identifies an individual.
- Redact properly, do not cover. Use a tool that deletes the text from the content stream. If your only option is a black box, export the page to an image afterwards — a flattened raster has no text left to extract.
- Check every layer and annotation. Open the layers panel and the comment list; delete anything hidden.
- Clear the document metadata. Author, title, subject, keywords, creator and producer should be emptied or rewritten.
- Remove attachments and embedded files. Check the attachments panel explicitly.
- Verify by attacking your own file. Select-all and copy into a text editor; run text extraction; search for the terms you removed. If any of them come back, the redaction failed.
- Flatten if in doubt. Rasterising pages destroys selectable text and hidden layers in one step. You lose searchability, which is often an acceptable trade for a document leaving your organisation.
Edit locally: the PDF editor opens your document in the browser so you can add text, place content and export the result without uploading it. For documents you are not permitted to put on a third-party server, keeping the whole edit local is the point.
Why doing this locally matters here specifically
Redaction is a confidentiality task, which makes the tooling choice part of the control rather than a convenience. Uploading a document to an online PDF editor in order to remove sensitive information means the un-redacted file has already reached someone else's server — and it may be retained there long after you receive the cleaned copy back. The upload defeats the purpose even when the redaction itself is performed correctly.
A local editor avoids the contradiction: the file is opened in browser memory, edited there, and exported from there. No copy exists anywhere else, so there is nothing to delete afterwards and nothing to explain to a client.
Special cases worth slowing down for
Scanned documents
A scan is a picture of text — there is no text layer to select or remove. Redacting requires destroying pixels, and OCR-generated text layers underneath the image must be handled too, or the text remains searchable even though the pixels are blacked out.
Signatures and handwritten annotations
These often sit in separate annotation objects. Deleting visible ink is not the same as deleting the annotation's metadata, which can include the signer's name and timestamp.
Forms and digital signatures
Removing content from a signed PDF breaks the signature — which is the correct behaviour, but worth knowing before you wonder why validation fails. If the document must remain signed, redaction is not the right tool; produce a redacted copy and sign that instead.
Spreadsheets exported to PDF
Hidden rows, hidden sheets and cell comments can survive export in some toolchains. Export only the visible range, then verify by extracting text.
Verification: the step everyone skips
The single most valuable habit is to attack your own output before sending it. Copy all text into a plain editor, search for each redacted term, and check document properties. It takes two minutes and catches nearly every failure mode described above. If a term still appears anywhere, assume the recipient will find it.
Frequently asked questions
Is a black rectangle ever acceptable?
Only if you subsequently flatten the page to an image, which destroys the text underneath. On its own, a covering shape is not redaction.
Does flattening remove hidden layers?
Rasterising merges everything visible into pixels and discards hidden content, so yes in practice. You lose selectable text and file-size efficiency as the cost.
What about document metadata?
It must be cleared separately — it lives outside the page content stream and survives page-level redaction entirely.
Will redaction break a digital signature?
Yes, by design: modifying content invalidates the signature. Produce a redacted copy and have that signed instead.
Is editing in the browser safe for confidential PDFs?
With a local editor, yes — the file is parsed and rewritten in browser memory and never transmitted. That is exactly the case this site is built for.