How to redact a PDF properly: why black boxes and white text don't work

A PDF is built in layers. Most editors let you add shapes, highlights or new text on top of a page, and everything you add sits above the original content instead of replacing it. On screen the result looks redacted. Inside the file, nothing has been removed.

Text left under black boxes has been recovered from documents published online, including legal filings, simply by copying and pasting. It is one of the most common ways confidential details leak.

You can check any document you have already "blacked out" in under a minute. Select the dark area, copy it and paste it into a plain text editor. Then type part of the hidden value into the PDF reader's search box. If either test turns up the text, it was never redacted.

Real redaction does two things together: it deletes the selected text from the file and draws a black box over the gap. The box is only a marker that something was there. What matters is that the value no longer exists anywhere in the document.

Redact PDF from PDFont reads and edits the file inside your browser. Neither the document nor the values it finds are sent to a server; they are held only in that tab's memory.

1. Open Redact PDF and add your document.
2. The tool finds IBANs, card numbers, phone numbers and email addresses on its own, along with a few national ID formats (Spain's DNI and NIE, Mexico's CURP and RFC, the Turkish ID number). Review the list and untick anything you want to keep.
3. US Social Security numbers, UK National Insurance numbers, passport and driving licence numbers, bank account numbers outside an IBAN, names and addresses are not recognised automatically. Type them into "Also search for", separated by commas, or draw an area over them.
4. For phone numbers written without a country code, choose your country in the Country list (the United States and the United Kingdom are both there) so they are recognised.
5. Drawing an area by hand turns that page into an image, so its text can no longer be selected or copied. Use typed search terms where you can and areas where you must.
6. Press Redact. The text is removed, black boxes are drawn and the new file is searched again for every removed value.
7. Open the result and repeat the copy-and-paste test on a value you removed. It should not be found.

A scanned page without an OCR text layer is just a picture, so nothing on it can be found automatically. Draw areas over what you want to hide, or black out the whole page. Those pages are rebuilt as new images with the areas filled in, and whatever was underneath cannot be recovered.

The same goes for images inside an otherwise normal PDF, such as a photo of a driving licence pasted into a form. Their contents are not read. Automatic detection saves time, but the final check is yours.

Visible text is only part of the story. Document properties can carry the author's name and company, comments keep the name of whoever wrote them, and a PDF can contain other files as attachments. When you redact, comments and form fields are removed from the copy, because they may hold personal data as well.

For everything else, run the redacted file through Remove PDF Metadata. It strips document properties, XMP data, scripts, attachments and comments while leaving the pages looking the same.

In the EU and the UK, the GDPR and UK GDPR include the principle of data minimisation: share only the personal data that is adequate, relevant and limited to what is necessary for the purpose. In the United States the rules depend on the sector and the state, and many organisations have their own policies on top. Whatever applies to you, the practical habit is the same: do not send more than the other side needs.

This guide is not legal advice. If you are unsure what you may share, talk to your organisation's privacy or compliance team, its data protection officer if it has one, or a lawyer.