How to redact a document properly

Redaction failures follow a script so consistent it is almost boring. A document is released with names blacked out. Within hours someone selects the text under the black rectangles, copies it, and pastes it somewhere readable. The information was never removed — it was covered up, in the most literal sense.

This has happened to law firms, government departments, courts and major newspapers. It is not a failure of care or competence. It is a failure of a mental model: people assume a PDF is a picture of a page, when it is actually a structured document with the text stored separately from the instructions for drawing it.

Why the black box does nothing

A PDF holds two things that matter here: the content — text strings, fonts, images — and the drawing instructions that determine what appears where. Drawing a filled black rectangle adds an instruction. It does not touch the text.

The text remains fully present in the file. It is still selectable, still searchable, still extractable with a single command. The rectangle sits on top of it in the visual stack, and that is the whole extent of the protection. Anyone who copies the region, runs pdftotext, opens the file in an editor that reorders layers, or simply moves the rectangle, has the original text.

The same failure appears in other forms:

The rule underneath all of these: if the information can still be recovered from the file, it has not been redacted. Whether it is visible on screen is a separate question, and the less important one.

What actually works

Use a real redaction tool

Proper redaction features do two things: cover the region, and delete the underlying content. Adobe Acrobat Pro has this under Tools → Redact, and the important step is applying the redactions — marking them is only the first half, and stopping there produces exactly the failure described above. On macOS, Preview added a redaction tool that removes rather than covers. Several open-source PDF editors offer the same, with varying reliability.

Whatever tool you use, verify afterwards. Every time.

Flatten to an image

The blunt, dependable method: export each page as an image, black out the regions in an image editor, then assemble the images back into a PDF. Because the output contains no text objects at all, there is nothing to extract.

The cost is that the document is no longer searchable or selectable, and file size usually grows. For a small number of pages where correctness matters more than convenience, this is a reasonable trade — and it is much harder to get wrong than layer-based approaches.

Redact at the source

The cleanest option is to never put the sensitive text in the file. Delete it in the original document, replace it with [REDACTED], and export a fresh PDF. No layering, no residue, no reversal. Where the workflow allows it, this is strictly better than any after-the-fact technique.

The parts people forget

Even a correctly redacted page can give the document away through channels that have nothing to do with the black boxes.

Verify before you release

Treat verification as a required step, not an optional one. It takes a minute and it catches nearly every real-world failure.

  1. Select all and copy. Open the finished PDF, press Ctrl+A (Cmd+A), copy, and paste into a plain text editor. Read what comes out. If any redacted string appears, the redaction failed.
  2. Search for the removed terms. Use the reader's find function on the exact names, numbers and addresses you intended to remove.
  3. Extract the text programmatically. pdftotext file.pdf - shows everything the file will yield to anyone else.
  4. Check the properties. File → Properties, or exiftool file.pdf for the full record.
  5. Check for attachments and annotations in the reader's sidebar panels.
  6. Open it on a different machine if the document is high-stakes. Fonts and layers sometimes behave differently in other readers.

If step one produces nothing but the visible, intended text, the redaction is real. If it produces the names you thought you had removed, you have found the problem before the recipient did — which is the entire point of doing the check.


Remove PDF metadata · What is EXIF data?