How to redact a PDF properly
A black rectangle over text is not a redaction. The words are still in the file, and anyone can read them in about four seconds. This is what actually works, and how to check that it did.
Last reviewed
The mistake, and why it keeps happening
A PDF page is a drawing program. Text is an instruction to place particular characters at particular coordinates, and a black rectangle is another instruction to fill an area. Drawing the rectangle does not remove the text — it draws over it. The characters are still in the file, underneath, and selecting the area copies them out. Any free tool extracts them in seconds.
The reason this keeps happening is that the interface tells you it worked. You draw a box, the words disappear from view, you save the file, and it looks exactly like a redacted document. There is no error, no warning, and no visible difference from a correct redaction. Every published redaction failure you have read about — unredacted court filings, settlement figures, witness names, an intelligence report whose deletions were recovered in minutes — was someone drawing a shape and believing it.
Highlighting the text in black is the same mistake wearing a different hat, and so is covering it with a white rectangle in a word processor before exporting to PDF.
What a real redaction does
The order is reversed. The text is deleted from the page content first, and the black box is drawn afterwards as a visual marker of where something used to be. Copy the redacted area and you get nothing, because there is nothing; extract the page text and the words are simply not present.
That is what redacting a PDF here does, and it reports how many pieces of text it removed — which matters, because a redaction that matched nothing looks identical to one that worked. If you drew a box over a name and nothing was removed, the name is probably part of an image rather than text, and needs the next paragraph.
Text in pictures is a separate problem
A name inside a scanned page, or in a screenshot pasted into a report, is not text at all — it is pixels. Deleting text cannot touch it, and a box drawn over it is exactly the ineffective covering described above, because the pixels underneath remain in the image data.
The fix is to re-render those pages with the redaction applied, so the pixels genuinely no longer exist. That is a real cost and worth knowing about: those pages become pictures, so any text on them stops being selectable and the file gets larger. For a scanned document that changes nothing, since it was already pictures. For a mixed document it is a trade.
The same applies to images generally. If you are blurring a face or a number plate, make it strong enough that the region carries no visible structure — researchers have reconstructed text from weak pixelation by generating candidates and matching them. If you can still guess how many characters were there, it is not strong enough.
The places a PDF keeps names you forgot
This is the part that catches out people who did the redaction correctly. A PDF stores text in more places than the visible page, and a perfect redaction of the page leaves every one of them intact.
The bookmark outline frequently contains section titles with names in them. Form field values persist even when the field is not visible. File attachments can be whole documents hidden inside the PDF. Document information and the XMP metadata packet carry the title, the author, the software and often the original file path — which reveals a username and a directory structure. Comments and annotations hold their own text and their author's name. And the file name itself travels with the document everywhere it goes.
There is one more, and it is the subtlest: a PDF saved incrementally keeps its earlier revisions inside the same file. If a document was edited and saved rather than rewritten, a previous version of a page may still be in there. This is why the verification step below is not optional for anything that matters.
Verify it, and how
Verification is the step people skip and the one that actually protects you. Three checks, in increasing order of thoroughness.
Open the result and try to select the redacted area. If you can copy anything, stop. This catches the basic failure in five seconds and is worth doing every single time.
Look at the document properties. Title, author, subject and keywords are visible in any PDF reader under File and then Properties. If the author field is the name you just spent an hour removing, the redaction achieved nothing.
Rebuild the file. Running the result through a tool that rewrites the document from what its pages actually reference — Ghostscript with gs -sDEVICE=pdfwrite, or qpdf --empty --pages out.pdf 1-z -- — discards unreferenced objects and earlier revisions. Adding exiftool -all:all= clears the metadata. For a court filing or anything under disclosure, do all three and have somebody else check.
Deleting a page is not redaction either
Worth stating on its own, because it is the same class of mistake. Removing pages from a PDF builds a new document from the pages you kept — but a link on a kept page that pointed at a deleted page still has to resolve, which drags a copy of that deleted page into the new file as an object no page tree references. Invisible in every reader, present in the bytes.
For removing a page from view, deletion is correct and sufficient. For removing its contents from existence, delete the page and rebuild the file as above.
Frequently asked questions
Is a black box ever acceptable?
Only as the visual marker on top of a real redaction. On its own it hides the words from a reader who is not looking and from nobody else. If the document will be published, filed or disclosed, treat a box alone as no redaction at all.
What about flattening the PDF instead?
Flattening burns annotations into the page, which does make a drawn box permanent as artwork — but the text underneath it is page content, not an annotation, so it is still there. Flattening is the right tool for locking in form answers and signatures, not for hiding words.
Can I redact by converting the PDF to images?
It works, in that a picture of a page with a box on it genuinely has no text underneath. The costs are real: the document stops being searchable, the file grows, and the metadata is usually carried across anyway — so you still have to clean that separately.
Does printing to PDF remove hidden text?
Usually yes for the page content, since the page is re-rendered — which is why it sometimes works by accident. It is not a reliable method, it does not clear every metadata field, and it depends on the printer driver. Use a tool that states what it removes.
Is it safe to redact a sensitive document on a website?
On this site nothing is stored at any point, which is the reason redaction is offered here at all — the documents people need to redact are exactly the ones that should not be sitting on a stranger's server. For a legal filing, use software built for the stakes and verify the result yourself.