How to redact a PDF properly, and why black boxes fail

Why a black box isn't redaction

A PDF page is built in layers. The text is stored as real characters, and anything you add on top — a black rectangle, a highlight in black, a shape drawn in a PDF editor — is a separate object placed over it. Viewers draw the box last, so on screen the words look hidden. But the characters are still in the file, in the same place, exactly as before.

That's why covered text can usually be recovered in seconds:

• Select and copy. Dragging across the black bar and pasting into a text editor often brings back the words underneath.
• Search. Searching the PDF for a name finds it even though you can't see it.
• Delete the box. In any PDF editor, the rectangle is just an object that can be moved or removed.
• Extract the text. Text extraction tools and screen readers read the characters, not what's drawn on top.

The same goes for changing the text colour to white or black, shrinking it to a tiny size, or covering it with an image. Anything that only changes how the page looks leaves the information in the file.

What proper redaction does

Real redaction removes the information from the file, not just from view. There are two common ways to do that: delete the characters themselves from the page content, or rebuild the page as a flat picture with the black boxes painted into it, so there is no text underneath to recover.

Our Redact PDF tool uses the second method. You type the words to black out — names, account numbers, a company — and can switch on all email addresses and all phone numbers. Every page with at least one match is rendered at 150 DPI with solid black boxes drawn in and saved as an image, so its text and links are gone. Pages without matches are copied unchanged and stay selectable.

Tip: On redacted pages you can no longer select or search the text. That isn't a bug — it's the proof that nothing is left underneath.

What redaction can miss

Automatic matching is only as good as the text it searches. Before you share a redacted file, know where details tend to slip through:

• Scanned pages. A scan is a picture of text, with no characters to search, so a typed name can't be matched there. Our redaction tool doesn't read scans yet.
• Different spellings. 'Jon' won't catch 'Jonathan', and an account number written with spaces won't match one typed without them. List each variant.
• Words split across lines. A name broken over two lines, or hyphenated at the end of a line, may not match as one term.
• Too-broad terms. Matching ignores capital letters and also finds words inside longer words, so 'Ann' blacks out part of 'Annual'. Use full names where you can.
• Form fields. Answers typed into a fillable form are stored as fields, not ordinary page text. Flatten the form first so the answers become part of the page, then redact and check the result.

Don't forget the hidden details

The visible page isn't the only place a PDF carries information. Most files also hold document details — title, author, subject, keywords, the app that made the file and dates — and the author is often filled in automatically from the name on the computer that created it. A redacted file from our tool is a new PDF, so the original's title, author and other document details aren't carried over.

For a document you're sharing without redacting, or to double-check any PDF before it leaves your hands, Edit PDF Metadata can remove all of it in one step: the document information and the embedded XMP metadata. Page content isn't touched, and the result shows what's left.

A checklist before you send

1. Keep the original somewhere safe and work on a copy — redaction can't be undone in the redacted file.
2. List every term and variant: full names, initials, account and reference numbers, addresses.
3. Run the redaction, then open the result and read every redacted page. Make sure each box covers the whole word.
4. Try to select or search for one of the redacted terms. On a properly redacted page, nothing should be found.
5. Check pages that weren't changed for details you didn't list, and for scanned pages that couldn't be searched.
6. If the file still needs protecting in transit, add an open password with Protect PDF and send the password separately.

If a document has to meet a legal or regulatory standard for redaction, follow the rules that apply to you or ask whoever set them — this guide explains how the technique works, not what the law requires.