How to redact a PDF

The instructions are easy to find and they are not wrong. Open the file, choose the redaction tool, drag over the text, click Apply, save. Acrobat has it under Protect; the free web tools put it on their front page; LibreOffice Draw will do it if you are willing to fight the import. If that were the whole job, this page would have nothing to add.

It is not the whole job, because none of those instructions tell you how to find out whether it worked — and in this particular task, a redaction that failed looks exactly like one that succeeded. Both produce a document with a black bar across a name. One of them still contains the name.

The failure you have already read about

Every year or two a redacted filing goes out and somebody discovers that the black bars come off. It has happened to court submissions, to government reports, to legal settlements, to corporate disclosures. The recovery method is never sophisticated. Someone drags a cursor across the black bar, presses Ctrl+C, and pastes.

The mechanism is worth understanding once, because it explains every other failure on this page. A PDF page is not a picture. It is a list of drawing instructions — set this font, move the pen here, show these characters — and a black rectangle is one more instruction appended to that list. It draws a filled shape at some coordinates. It does not delete the instruction above it that draws the text. Both instructions execute, one after the other, and the second one paints over the first on screen while both remain in the file. Select the area and your reader dutifully hands back what the page says is there.

This is why the annotation tools, the markup tools, the highlighter set to black, the shape tool, the drawing tool in Preview on a Mac and the “fill with black” in almost any editor are all the wrong tool. They add a shape. Real redaction has to remove the characters, and that is a different operation with a different name in every application that offers it.

Four ways to check, and what each one actually proves

Do these on the finished file, not on the one you were editing. They take about a minute between them and they fail in different ways, which is the point of doing more than one.

Select and copy. Open the output in any reader, drag across the black bar, and press copy. Paste it somewhere. If anything arrives, the redaction is cosmetic and the document is not safe to send. This catches the classic failure instantly and it needs no tools. It has one blind spot: some readers refuse to select text under an opaque shape, so a clean result here is encouraging rather than conclusive.

Search inside the file. Use your reader’s find function and search for the redacted word. This is stronger than selecting, because search reaches text the selection tool may skip, and it is the check most likely to catch the same name sitting in a header, a footer or a distribution list on a page nobody thought about. That second case is the failure that actually happens in offices: the passage everyone was looking at gets redacted properly, and the copy of it three pages later does not.

Extract the text. This is the honest one, because it bypasses the reader entirely and asks the file what it contains. On a Mac or Linux machine with poppler installed, pdftotext output.pdf - prints everything the document holds. If you would rather not install anything, run the finished file through PDF to text and read what comes back — it does the same extraction in your browser. A page that was genuinely rebuilt returns nothing at all for that page. A page with a shape on top returns the name.

Look at the file size. A weak signal, but a free one. Genuine redaction of a page usually means the page was rebuilt as an image, and that makes the file noticeably larger. If your “redacted” copy is within a few hundred bytes of the original, very little was removed and something was probably only added.

What survives a redaction that went well

Suppose the text really is gone. There is a second category of leak that has nothing to do with the black bars, and it is the one that catches careful people.

Document metadata. A PDF carries a title, an author, the application that produced it, and creation and modification timestamps. A file whose title is Termination memorandum — John Q Public announces the name in every file manager, every mail client and every search index, without anybody opening it. Redacting the body does nothing to that field.

The XMP packet. Many PDFs carry a second copy of the same metadata as an embedded block of XML. Clearing the document properties in an editor often clears the first copy and leaves this one behind, which means the information can survive the exact cleanup that was supposed to remove it.

Previous versions of the file. PDF supports incremental saving: an edit can be appended to the end of the file while the original bytes stay in place. A document that was redacted and saved this way can literally contain both versions, and recovering the older one is a matter of reading the earlier cross-reference table. Saving a fresh copy rather than saving over the original avoids this entirely.

Embedded thumbnails and images. Some producers store a small preview image of each page. If the preview was generated before the redaction, it is a picture of the unredacted page, sitting inside the supposedly safe file.

The image underneath. If the sensitive content was part of a photograph or a scan rather than text, removing the text layer achieves nothing, because there was no text layer. The pixels have to go. Any tool that only strips characters will report success on a scan and leave the picture untouched.

“In your browser” is a claim you can check

Guides in this category, and the automated summaries built on top of them, routinely describe the free web tools as working in your web browser. Read literally, that would mean the document stays on your machine. For most of those services it does not: the file is sent to a server, processed there, and sent back, which is why they can offer features a browser cannot run and why they all have a retention policy explaining how long your upload is kept.

That distinction is not a matter of trust, because it is directly observable. Open the developer tools in your browser, switch to the Network tab, and use the tool. Watch the request list while you hand in the file. An upload is unmistakable — a request carrying megabytes of body — and its absence is equally unmistakable. If you want the stricter version of the test: hand in the file, then disconnect from the network completely and continue. Work that finishes offline never left. Verifying that a tool runs locally covers the procedure in more detail, including the traps.

It matters more here than for almost any other kind of file operation. Redacting a document is a declaration that it contains something which must not be seen, and the ordinary workflow begins by transmitting that document, intact, to somebody else. The protection arrives after the disclosure it was meant to prevent.

Doing it, and doing it checkably

If you have Acrobat Pro, its redaction tool is genuine: it removes the underlying content rather than covering it, and Sanitize Document handles the metadata. It is the right answer for anyone who already pays for it, and it is a poor answer for the far larger number of people who do not — which is what the 320 monthly searches for redacting a PDF without Adobe Pro are about.

The free alternative that does not involve uploading is redacting the PDF in your browser. Point at the text you want gone and it reads back the exact characters it will remove, so you can confirm the placement before anything happens. The pages you marked are rebuilt without their text; the pages you did not mark are copied through untouched and keep their fonts, their layout and their selectable words. The document metadata is listed for you first and none of it reaches the output. And when the file is written it is opened again and measured: how many characters remain on each page, and whether the text you covered still appears anywhere else in the document.

Then run the checks in this article on the result anyway. Not because the tool is untrustworthy, but because a check performed by the thing being checked is one check, and the whole argument of this page is that one is not enough. Use the select-and-copy route and an extractor that has never seen the tool that made the file. Agreement between two independent methods is worth more than either one alone.