How to Redact a PDF Properly

“Redacted” is a claim about bytes, not appearances. When a document has been properly redacted, the sensitive characters no longer exist in the file — they cannot be searched, selected, copied, or extracted, because they are gone. Everything else — the black box, the highlight, the deleted-looking page — is drawing. This guide is the overview for the redaction family; the detailed SSN walkthrough and the public-disclosure scenario sit beneath it.

What Counts as Removal

The PDF format stores page text in a content stream. Real redaction removes the characters from that stream. A covering box, by contrast, sits on top of the text — and the text underneath is still there, one drag-select or one text extraction away from anyone who opens the file. That is why the defining property of a proper redaction is not what the page looks like, but what the file contains.

The same test puts every other “protection” in its place:

• A password controls who can open the file; it does not remove anything. An encrypted, unredacted file still contains every sensitive character.
• A deleted page thumbnail does not guarantee the page’s content is gone from the file.
• A flattened annotation is still an annotation, not a removal.

The Workflow

1. Find the sensitive content. Do not hunt by eye across a long document. detect PII automatically recognizes emails, ID numbers, and similar patterns in your browser — free — and lists candidates; there is an optional server-side step that uses quota for heavy files. Review every candidate before you remove anything — an automatic list tells you where to look, not what to delete.

2. Remove from the content stream. redact a PDF deletes matched text locally — free, no upload — with an optional cloud pass for heavy files; redact PII from a PDF applies a whole reviewed batch in one pass. For one specific ID number, the SSN walkthrough shows the full single-item sequence.

3. Verify on the saved file. This is the step that makes the claim true. Reopen the saved output, search for the redacted strings, try to select them, run extract text from a PDF over the whole document. If any of it still finds the sensitive text, the redaction failed — and the failure is in the file, not in the view.

4. Scrub what the page never showed. Document properties — author, title, creator software, custom fields — can carry names and identifiers that no page ever displayed. remove metadata from a PDF as the closing step, and for files going somewhere adversarial, sanitize a PDF strips embedded scripts and active content in the same spirit.

5. Set the access boundary. password-protect a PDF — in your browser, free — controls who opens the distributed file. It is a boundary, not a removal, and it is no substitute for steps 1–4.

Scans: The Exception That Has a Rule

A scanned page has no content-stream text to remove, so text redaction on a scan works on the recovered layer: run OCR a PDF first — on-device recognition, free, no upload — redact the recognized text, and then decide separately whether the underlying image pixels still carry the words. Covering pixels with a black box is only removal if the pixels themselves are destroyed.

Keep a Clean Master

Removal is permanent and one-directional. Keep the unredacted original wherever your sensitive masters already live, and redact the copy you distribute. The cleanest pattern for repeated filings is redact-on-copy: one master, one redacted derivative per recipient, so no single mistake propagates backward into the source.

Frequently Asked Questions

Can redaction be undone? No — that is the point. The bytes are gone. Which is the reason to keep a clean master and to confirm each candidate before you run.

Is a password-protected PDF with a black box over the number redacted? No. The password gates access; the box covers pixels. The number is still in the file, and anyone who gets past the gate reads it.

Do the local steps really never upload anything? Yes — the finding and removal steps run in your browser with nothing transmitted, which you can confirm in ten seconds in your browser’s network panel. The optional heavy-file steps run on encrypted infrastructure, and any output is kept for the site’s one retention window and then automatically deleted; the retention rule is the single source.

What’s the minimum I should do? Find it, remove it, verify on the saved file, clean the metadata. Skip the verification and you have a document that looks redacted — which is precisely the state that fails.

---

Proper redaction is a testable claim, and the test is the file: after you are done, the sensitive characters must not exist in it. Find the content, delete it from the content stream, verify with search and extraction on the saved file, scrub the properties, keep a clean master. That sequence — nothing less — is what “redacted” means.

Do It Directly

Ready to redact the file in front of you? detect PII automatically to list the candidates in your browser — free — then redact a PDF or redact PII from a PDF to remove them locally, and verify with extract text from a PDF on the saved copy. Close with remove metadata from a PDF and, for adversarial destinations, sanitize a PDF. Keep a clean master.

Related reading

• Redact an SSN From a PDF — the detailed walkthrough for the single most common redaction target
• Prepare a Filing for Public Disclosure — the scenario this workflow serves: a filing that goes to people you cannot predict
• How Long Are My Files Kept? — the one retention rule behind the optional cloud steps