How to Redact a PDF Properly

Every year or so a redacted document is published, someone selects the blacked-out passage, pastes it into a text editor, and reads it. The people who prepared it were not careless in an unusual way. They did the obvious thing, and the obvious thing does not work.

Why the black box fails

A PDF is not an image of a page. It is a list of drawing instructions: place this glyph at this coordinate, fill this rectangle with this colour. When you draw a black rectangle over a name, you append one more instruction to that list. The instruction that draws the name is still there, still earlier in the list, still fully intact. You have covered it visually and changed nothing about the file's contents.

Which means all of the following still recover it:

• Selecting the text and copying it.
• Any command-line text extractor, in one line.
• Removing the annotation layer, if the box was added as an annotation.
• Search — the document will still match on the word you thought you removed.

The same applies to highlighting in white, to covering text with an opaque image, and to setting the text colour to white. All of them are visual tricks over an unchanged content stream.

What real redaction requires

To genuinely remove text from a PDF you have to eliminate the instructions that draw it. There are two defensible ways to do that, and they have different costs.

Remove the text objects and keep the PDF as a PDF. Surgical, keeps the rest of the document selectable and small. It requires rewriting the page's content stream, and you must be sure you caught every place the string appears — including document metadata, bookmarks, attachments and any XMP block, all of which are separate from the visible page.

Flatten the page to an image and burn the black bars into the pixels.Brutally reliable: after rasterisation there is no text anywhere on the page, so there is nothing to recover. The cost is real — the page is no longer selectable or searchable, the file gets larger, and quality is fixed at whatever resolution you chose.

The redaction tool here takes the second route deliberately, and rasterises the affected pages with the bars appliedbefore the image is encoded, so the covered pixels never exist in the output at any stage. For a document you are about to hand to an opposing party or publish, that irreversibility is the feature. If searchable text matters more than certainty, you should be editing the text instead, in the PDF editor.

The parts people forget

Even correct page redaction leaves these behind, and they have leaked plenty of documents on their own:

• Metadata. Author, title and producer fields routinely contain a real name, a client name or an internal file path.
• Bookmarks and the outline tree. Often written from the original headings, which may include the name you removed from the body.
• Attachments and embedded thumbnails. A page thumbnail generated before redaction is a small picture of the unredacted page.
• Filenames. settlement-draft-SMITH-confidential.pdf tells the story without being opened.
• Context. If you black out one name in a list of five and the remaining four are known, you have redacted nothing. Redaction is an information problem, not only a technical one.

Verify before you send

Treat this as mandatory, not optional. Reopen the finished file, try to select the redacted area, and run a text search for the exact string you removed. If either returns anything, the redaction failed. Doing this locally is straightforward — and because nothing here is uploaded, the draft with the secrets still in it never leaves your machine, which is not something you can say about a service you email the document to. That is the same argument as editing a PDF without uploading it, with sharper consequences.