Redact PDF text
Mark what should not be read, and the words underneath go with it. Runs in your browser — no upload, no account.
Runs in your browser 0 bytes uploadedDrop the PDF you need to redact
Nothing is uploaded. The page is redrawn here, in this tab, out of bytes that never leave it.
Redact PDF pages without first handing over the document
There is a contradiction at the heart of every online redaction tool, and it is worth saying out loud before anything else. Marking part of a document for redaction is a statement that the document contains something which must not be seen. The standard workflow then asks you to upload that document — unredacted, in full, including the very passage you are trying to protect — to a server belonging to a company you have never met, so that the passage can be removed afterwards. The disclosure happens first and the protection second, which is the wrong way round for the only thing that mattered.
Reverse the order and the contradiction goes away, which is the whole design here: your file stays on the disk it is already sitting on. Two pieces of machinery arrive from this domain when you first hand something in — one that draws pages, one that writes PDFs — and both are byte-for-byte the same for every visitor. After they land, the wire goes silent. That is a claim, and claims of this shape are cheap to make and quick to falsify: watch the request list in your developer tools while you work, and you will see the difference between fetching a program and sending a document. For the stricter version, hand the file in so the machinery loads, then take the machine off the network and finish the job anyway. Checking a tool for yourself takes about a minute, and the procedure applies to this site exactly as much as to any other.
PDF, in brief
| Full name | Portable Document Format |
|---|---|
| Extension |
.pdf
|
| Format type | Fixed-layout document |
| MIME type |
application/pdf
|
PDF redaction that removes the text, not just the view
The famous failure in this category is not a rare bug; it is what most people do by default. A black rectangle drawn in a PDF editor is a shape added on top of the page. The characters underneath are still recorded in the file, in full, and anybody can select them with a mouse, copy them, or run an extraction tool and read every one. Court filings, government releases and corporate disclosures have all shipped that way, and the recovery is not hacking — it is dragging across a black bar and pressing Ctrl+C.
What happens here instead is that a page you marked is redrawn. The page is rendered to pixels at the resolution you pick, the marked areas are painted into those pixels, and the page written into the output is that image. It carries no text objects at all, because it carries no text: there is nothing left underneath to select, because there is no underneath. Pages you did not mark are not touched. They are copied straight through and keep their selectable text, their embedded fonts and their exact dimensions, so a four-page memo with one sensitive line does not become four pages of pictures.
Document metadata is the second leak and the one almost nobody looks for. A PDF carries a title, an author, the application that produced it, creation and modification timestamps, often keywords, and frequently an XMP packet repeating all of it as XML. A file whose title is the name of the person it concerns announces that name in every file manager, every mail client and every search index without anyone opening it. Everything the document carries is listed for you before the run, field by field, and none of it reaches the output — which is written with no metadata whatsoever, including ours. There is no producer string and no timestamp, because a timestamp recording when a document was redacted is exactly the sort of trace this operation is supposed to remove.
That clearing is a side effect here, not the point, and it arrives bundled with pages that have been turned into pictures. When the pages are fine and only the invisible fields are the problem — a contract about to be sent outside the building whose author field still names the person who drafted it — stripping the metadata on its own leaves every page exactly as it was, text still selectable, and touches nothing you can see.
How to check that a redaction actually took
Every competitor stops at the word Apply. This one measures its own output and shows you the numbers, and the three checks are deliberately three, because they prove different things and are easy to confuse for one another.
Before the run, each marked area reports the exact characters it covers. Point at a name and the tool reads that run back to you, character count and all. That is the only check which says anything about placement, and the one you can hold against your own screen in a second. After the run, the finished file is opened again and its text is counted, page by page — zero on the pages that were rebuilt, and a real number on the pages that were not, which is the evidence that the rest of the document was left alone rather than quietly flattened. Then the text you covered is searched for across the whole finished document, which catches the mistake that genuinely happens: nobody forgets to black out the name they are looking at, and everybody forgets the distribution list two pages later.
One limit belongs in the same breath, because a check that oversells itself is worse than none. A character count proves the text layer is gone; it cannot prove the black box landed where you meant it to. A rebuilt page reads zero characters whether the box fell on the name or three centimeters beside it. That is precisely why the covered-text readback exists and why it comes first, and why the finished file is shown to you rather than merely offered for download. PDF to text is a useful second opinion from outside the tool: run the downloaded file through it and read what comes back.
What a rebuilt page costs, said before you run it
Turning a page into an image is not free, and the price is quoted above the button rather than discovered afterwards. Text on that page stops being selectable and searchable. A screen reader finds nothing there. The page cannot be edited or reflowed later, and the file grows, because a picture of a page is much larger than the instructions for drawing one. How much larger is worth a measured number rather than a shrug: our own four-page test document weighs 4,289 bytes, and rebuilding a single one of its pages takes it to 25,451 bytes at 150 DPI and 64,039 at 300. A text page is the worst case for that ratio, since text compresses beautifully as instructions and poorly as pixels; a scanned page starts heavy and grows far less. Every bit of this applies only to the pages you marked, and their numbers are named before anything runs.
Resolution is the one dial worth having, and it has three positions rather than a slider, because values in between make no visible difference to a page of text. 150 DPI reads cleanly on screen and prints acceptably; 300 DPI is for a document that will be printed and read closely, and costs roughly four times the pixels. No ceiling is enforced on anything, in or out. Hand over something enormous and you are told what the tab is about to be asked to hold, and then it is asked to hold it, because the hardware belongs to you and so does the call about what it can survive.
What this page does not do
It does not recognize text in a scan. A scanned page has no characters in it at all, so there is nothing to point at — the tool says so on the page in question instead of leaving you clicking at pixels — and you draw a box over the area instead. The page is rebuilt either way, so the redaction is just as real; what you do not get is the character readback, for the simple reason that there were never any characters to read.
It does not find sensitive information for you. There is no scan for social security numbers, no name detector, no confidence score. A tool that highlights nine numbers out of ten and says nothing about the tenth has not helped, it has produced a false sense of completion — and false completion is the entire failure mode this page exists to fight. What it does offer is a search box: type a name and every occurrence of it on every page is marked at once, which is the version of that feature that cannot quietly miss something without telling you how many it found.
And there is no undo direction. Redaction has no opposite, because once the words are gone they are gone — which is exactly the property a black rectangle drawn on top does not have. If you need to take pages out of a document rather than words out of a page, splitting a PDF runs a different operation and often the better one: sending only pages two and three is safer than sending a redacted copy of all forty. Putting documents together again is merging PDF files. And how to redact a PDF walks through the whole job step by step, including how to check the result in a tool that is not this one.
Questions
Does my PDF get uploaded?
No, and this site operates no endpoint that could receive one. What travels down the wire is machinery: a page renderer, a PDF writer, and occasionally a font file that an unusual document needs in order to draw correctly. All of it is identical for every visitor, all of it comes from this domain, and none of it is fetched until you hand something in, so a person who reads this page and leaves downloads none of it. Watch the request list while you work and the difference between collecting a program and transmitting a document is unmistakable. That difference weighs more on this page than on any other here, because marking a passage for redaction is a declaration that the document holds something which must not travel, and the customary workflow starts by making it travel.
Does this actually remove the text, or just cover it?
It removes it, and the mechanism is worth knowing because the failure mode is famous. Drawing a black rectangle in a PDF editor adds a shape on top; the characters are still in the file, and anybody can select them, copy them, or run a text extractor and read every one. Here, a page you marked is redrawn as an image at the resolution you choose, the black areas are painted into those pixels, and the rebuilt page carries no text objects at all. Pages you did not mark are copied through untouched, so they keep their selectable text, their fonts and their exact dimensions.
What does the redacted page lose?
The page becomes a picture, and that has consequences worth weighing before you run it rather than after. Text on that page stops being selectable and searchable, a screen reader finds nothing there, and the page cannot be reflowed or edited later. The file also grows, because a picture of a page is much larger than instructions for drawing one. All of that is said above the button, with the page numbers involved, and it applies only to the pages you marked — the rest of the document is untouched.
How do I know the redaction worked?
Three checks, and they prove different things. Before you run anything, each box reports the exact characters it covers, so you can read back what will disappear. After the run, the tool reads its own output and reports how many characters of text remain on each page — zero on the pages that were rebuilt. And the text you covered is searched for across the whole finished document, which catches the failure that actually happens in practice: the same name appearing on a page you did not mark. One honest limit belongs with that: a character count proves the text layer is gone, not that the box landed where you meant. Reading back what each box covers is the check that proves placement, which is why it exists.
What happens to the document metadata?
It is listed for you before the run and none of it survives into the output. A PDF carries a title, an author, a creator application, creation and modification timestamps, sometimes keywords, and often an XMP packet repeating all of it in XML. That is a real leak and an easy one to miss, since a document titled with the name of the person it concerns announces it in every file manager without anyone opening it. The output carries no metadata at all, including ours: this tool writes no producer string and no timestamp, because a timestamp saying when a document was redacted is exactly the kind of trace the operation is about.
Can I redact a scanned PDF?
Yes, and it is one of the cases this handles cleanly. A scan has no text layer, so there is nothing to point at — the tool says so on the page in question rather than leaving you clicking at pixels — and you draw a box instead. The page is rebuilt as an image with the box painted in, exactly as for any other page. What you do not get on a scan is the character report, for the simple reason that there were never any characters to count; the check that still applies is the one where you read back what the box covers, and on a scan that is your own eyes on the preview.
Is there a page or file size limit?
No ceiling is enforced. A heavy document earns a plain description of what the tab is about to be asked to hold, and then it is asked to hold it, because the machine belongs to you and so does the call about what it can survive. Memory rather than time is the wall worth knowing about: the source document, the drawn page, the painted canvas and the finished file are all alive at the same moment, and a sheet drawn at 300 DPI occupies roughly four times the pixels of the same sheet at 150. Carrying a very long job across two passes costs nothing if a tab does begin to struggle.
Why not remove the text without turning the page into an image?
Because doing that correctly is a much larger job than it appears, and doing it incorrectly is worse than not offering it. Removing exactly the characters inside a box means parsing the page description, tracking every piece of text state as it changes, and measuring glyph widths out of each embedded font to work out where a character actually sits — and it still gives the wrong answer for text drawn inside a reusable form object or an annotation. A tool that gets that subtly wrong produces a document that looks redacted and is not, which is the precise failure this page exists to prevent. Rebuilding the page as an image has a real cost, stated up front, and it has one property nothing else offers: the result can be measured rather than trusted.