How to redact a PDF properly: remove the text, don’t just cover it

Covering vs. removing: what happens inside the PDF

A PDF page is a stack of drawing instructions: put this text here, place this image there, fill this rectangle black. When you add a black box with a shape or highlighter tool, you add one more instruction to the top of the stack. The text instruction underneath is untouched. It’s still in the file and still selectable, and anything that reads PDF text will read it: search, copy and paste, screen readers, a three-line script.

Real redaction works the other way round. It deletes whatever is in the marked area, so nothing is left underneath. Adobe Acrobat, for example, separates marking an area from applying the redaction, and only the apply step removes anything. Removing hidden information like metadata is offered as a separate step after that (Adobe’s redaction guide).

How mypdf removes the text

When you apply redactions, every page with at least one black box is rendered as a high-resolution image (about 200 DPI for manual redaction and 180 DPI for auto-redact). The black boxes are painted into that image, and the image replaces the original page. The page’s text, fonts and vector drawings aren’t copied into the new file. Pages with no redactions are copied across unchanged.

There’s a trade-off: on a redacted page, all the text becomes part of the image, not just the part you blacked out. Nothing on that page can be selected or searched any more. If you need it searchable again, run OCR on the redacted file. OCR only reads what’s visible, so it can’t bring the removed words back.

All of this runs in your browser tab. The PDF is never uploaded, which matters for exactly the kind of document that needs redacting.

Check that the text is really gone

This takes about a minute, and it’s the step that would have prevented most of the redaction failures that make the news. Do it on the downloaded file.

• Select through the box. Open the PDF in any viewer and drag your cursor across a black bar. Nothing should highlight.
• Search for what you removed. Press Ctrl+F (Cmd+F on a Mac) and type a name or number you blacked out. You should get zero results.
• Copy the whole page. Select all, copy, and paste into a plain text editor. A redacted page gives you nothing, because it’s now an image.
• Check the rest of the document. Run Extract text on the whole file and search the output for the same words. They often appear again on pages you didn’t redact, like a summary table or a footer.

What redaction doesn’t touch

Redaction works on what’s drawn on the page. A PDF can carry information in other places, and each needs its own fix:

• Document properties such as author, title and the app that made the file. Clear them with Remove metadata as the last step before you send.
• Comments and annotations on pages you didn’t redact are copied across as they are. Check your PDF viewer’s comments panel and delete anything that shouldn’t travel.
• Attachments. A PDF can carry whole files inside it. PDF audit lists them, and Deep Clean removes them.
• The file name. “Smith_disciplinary_final.pdf” gives away what the black bars are hiding. Rename the file before you send it.
• The same detail somewhere else. A blacked-out account number doesn’t help if the last four digits appear in a table on page 12.

Automatic detection is a first pass

Auto-redact looks for information with a recognisable shape: email addresses, US phone numbers, international numbers written with a + country code, card numbers that pass a checksum, IBANs, US Social Security numbers, and Aadhaar- and PAN-style IDs. It’s good at catching the one you’d have missed on page 40.

It can’t tell that a person’s name is sensitive, that a project codename is confidential, or that a street and a date together identify someone. Local phone numbers written without a country code may be missed too. Treat the automatic pass as a checklist, then read the document yourself.

Limits worth knowing

• Redacted pages become images: nothing on them can be selected or searched, and they’re often larger than before.
• Automatic detection only covers the patterns listed above. Names, addresses and context-dependent details need manual boxes.
• Scanned pages need OCR before the automatic scanner can find anything on them.
• Comments on pages you didn’t redact are kept. Delete them in your PDF viewer if they shouldn’t be shared.
• Password-protected PDFs have to be unlocked before they can be redacted.
• Redaction is permanent in the file you download. Keep your original.

Sources

1. Adobe Help Center, Redact sensitive content in Acrobat Pro