How to redact a document properly
Redaction failures follow a script so consistent it is almost boring. A document is released with names blacked out. Within hours someone selects the text under the black rectangles, copies it, and pastes it somewhere readable. The information was never removed — it was covered up, in the most literal sense.
This has happened to law firms, government departments, courts and major newspapers. It is not a failure of care or competence. It is a failure of a mental model: people assume a PDF is a picture of a page, when it is actually a structured document with the text stored separately from the instructions for drawing it.
Why the black box does nothing
A PDF holds two things that matter here: the content — text strings, fonts, images — and the drawing instructions that determine what appears where. Drawing a filled black rectangle adds an instruction. It does not touch the text.
The text remains fully present in the file. It is still selectable, still searchable, still extractable with a single command. The rectangle sits on top of it in the visual stack, and that is the whole extent of the protection. Anyone who copies the region, runs pdftotext, opens the file in an editor that reorders layers, or simply moves the rectangle, has the original text.
The same failure appears in other forms:
- Highlighting in black in a word processor, then exporting to PDF. The text is still text.
- Changing font colour to white. Invisible on screen, perfectly intact in the file.
- Placing an image over the text. Same layering problem.
- Pixelation and blurring. Weaker than it looks — both are reversible to a degree, and for short, structured strings like phone numbers, licence plates or dates, the space of possible originals is small enough that reconstruction is realistic.
- Swirl or mosaic filters applied to faces. Several of these transformations have been reversed in practice.
The rule underneath all of these: if the information can still be recovered from the file, it has not been redacted. Whether it is visible on screen is a separate question, and the less important one.
What actually works
Use a real redaction tool
Proper redaction features do two things: cover the region, and delete the underlying content. Adobe Acrobat Pro has this under Tools → Redact, and the important step is applying the redactions — marking them is only the first half, and stopping there produces exactly the failure described above. On macOS, Preview added a redaction tool that removes rather than covers. Several open-source PDF editors offer the same, with varying reliability.
Whatever tool you use, verify afterwards. Every time.
Flatten to an image
The blunt, dependable method: export each page as an image, black out the regions in an image editor, then assemble the images back into a PDF. Because the output contains no text objects at all, there is nothing to extract.
The cost is that the document is no longer searchable or selectable, and file size usually grows. For a small number of pages where correctness matters more than convenience, this is a reasonable trade — and it is much harder to get wrong than layer-based approaches.
Redact at the source
The cleanest option is to never put the sensitive text in the file. Delete it in the original document, replace it with [REDACTED], and export a fresh PDF. No layering, no residue, no reversal. Where the workflow allows it, this is strictly better than any after-the-fact technique.
The parts people forget
Even a correctly redacted page can give the document away through channels that have nothing to do with the black boxes.
- Document properties. The Author field usually holds a real name pulled from the operating system account. Creator and Producer identify the software and version. Timestamps show exactly when the file was made and last touched. A carefully redacted document that names its author in the properties has achieved very little. Strip document metadata as a matter of routine.
- Revision history. Some PDFs contain incremental updates — earlier versions of the file appended within the same document. In such files, previous states of the content can be recovered. Saving a fresh copy rather than incrementally updating avoids this.
- Comments and annotations. Review notes are separate objects. They may not print, but they are in the file.
- Bookmarks, form fields and the table of contents. These frequently reproduce headings containing the very names redacted from the body.
- Attached files. A PDF can embed other documents, including the source spreadsheet or the unredacted original.
- The filename. A file called
Smith_settlement_final.pdfis not anonymous regardless of what is inside. - Layout as a fingerprint. The length of a blacked-out region reveals the length of the name underneath. Where the candidate pool is small — an internal memo, a named party in a known case — the width of a rectangle can be decisive. Redacting to a uniform block width defeats this.
Verify before you release
Treat verification as a required step, not an optional one. It takes a minute and it catches nearly every real-world failure.
- Select all and copy. Open the finished PDF, press Ctrl+A (Cmd+A), copy, and paste into a plain text editor. Read what comes out. If any redacted string appears, the redaction failed.
- Search for the removed terms. Use the reader's find function on the exact names, numbers and addresses you intended to remove.
- Extract the text programmatically.
pdftotext file.pdf -shows everything the file will yield to anyone else. - Check the properties. File → Properties, or
exiftool file.pdffor the full record. - Check for attachments and annotations in the reader's sidebar panels.
- Open it on a different machine if the document is high-stakes. Fonts and layers sometimes behave differently in other readers.
If step one produces nothing but the visible, intended text, the redaction is real. If it produces the names you thought you had removed, you have found the problem before the recipient did — which is the entire point of doing the check.