How to redact a PDF properly (black boxes are not enough)

There is a particular kind of embarrassment that arrives when a redacted document turns out not to be redacted. It has happened to law firms, to government departments, to newspapers, and to companies filing court documents. The pattern is always the same: someone draws black rectangles over the sensitive parts, saves the file, and publishes it. A reader selects the blacked-out area, copies it, pastes it into a text editor, and reads every word.

This is not a rare software bug. It is the expected result of a very common misunderstanding about what a PDF actually is.

Why a black rectangle hides nothing

A PDF is not a picture of a page. It is a set of instructions describing what to draw and where. A line of text is stored as the characters themselves, plus a font reference and coordinates saying where on the page they belong. That is precisely why you can select text in a PDF, search it, and copy it out.

When you draw a filled rectangle over a name, you have added one more instruction to that list: draw a black box at these coordinates. You have not removed the instruction that draws the name. Both instructions remain in the file. The viewer executes them in order, the box is painted after the text, and visually the name disappears.

The characters, however, are exactly where they always were. Any tool that reads the text layer rather than the rendered image finds them untouched. Copying and pasting is the simplest way. Text extraction tools do it just as easily, and so does any search index that processes the file.

• Selecting and copying the covered area reveals the text in most viewers
• Text extraction returns the hidden words in full
• Search engines index text they cannot see on screen
• Moving or deleting the rectangle in an editor exposes it immediately

The same trap catches people who use a highlighter set to black, a white rectangle over white-background text, or an image pasted on top. Every one of those is a drawing operation layered above text that remains in the document.

What proper redaction actually does

Real redaction removes the underlying content and then covers the space. Two separate things have to happen, and the order matters: the text objects in that region are deleted from the file, and only then is a black mark drawn to show that something was removed.

Afterwards there is nothing to select, because the characters no longer exist in the document. Copying the area returns nothing. Extraction returns nothing. The only way to know what was there is to have the original.

A cruder but effective approach is to flatten the page to an image. Once the page is a photograph of itself there is no text layer at all, and nothing to recover. This is a genuine option for short documents, though you lose the ability to search or select any of the remaining text, and the file usually grows considerably.

How to redact a document safely

1. Work from a copy. Keep the unredacted original somewhere separate, because redaction is not reversible and you may need the full version later.
2. Identify everything that must go, not just the obvious names. Account numbers, addresses, dates of birth, signatures, reference numbers and email addresses all identify people.
3. Apply the redaction with a tool that removes content rather than drawing over it.
4. Save the redacted copy under a different filename so the two never get confused.
5. Verify before sending. Open the result, try to select the redacted regions, and copy the whole page into a text editor to confirm nothing survives.

That last step is the one people skip, and it takes about fifteen seconds. Select all, copy, paste into any plain text editor, and read what comes out. If a redacted name appears in that paste, the redaction failed and the document is not safe to send.

The parts people forget

Content visible on the page is only half the problem. PDFs carry metadata that travels with the file and is rarely examined.

• Document properties: author name, organisation, and the software used to create it
• Revision history in files exported from some editors
• Attachments and embedded files carried inside the PDF
• Bookmarks and link targets that can quote text from the redacted section
• The filename itself, which frequently contains a client or case name

Scanned documents have the opposite problem, and it catches people out in the other direction. A scan is already an image, so there is no text layer to leak. But if the document has been through OCR, an invisible text layer sits behind the image, and a rectangle drawn on the picture does nothing to that layer. A scanned file is only safe if you know for certain that OCR was never applied.

When redaction is not the right tool

If a whole page is sensitive, remove the page rather than blacking out most of it. A page that is ninety percent black tells the reader a great deal about how much was there, and leaves more opportunity for something to survive.

And if the document exists in an editable original, redacting the source and exporting again is usually cleaner than operating on the PDF. You control exactly what is written rather than surgically removing it afterwards.

Assume every redaction will be tested by someone motivated to break it, because eventually one will be.

The check costs seconds. The alternative has cost organisations rather more than that.