How to redact a PDF properly
A black box on a PDF looks final. Often it isn’t: the text is still in the file, underneath the box, and anyone can copy it out. This guide shows you how to tell the difference in 30 seconds, and how to redact so the words are really gone.
Why black boxes and highlighting fail
A PDF stores text and drawings in layers. Drawing a black rectangle, or highlighting text in black, adds a shape on top. The text below is untouched, so it can still be selected, searched and copied.
This has caught out law firms and governments for years. In 2010, the SANS Internet Storm Center described a court filing whose hidden passages were recovered with select-all and copy-paste.1 Ireland’s Data Protection Commission warns against the same mistake in Word files: highlighting or changing the colour of text does not remove it, and exporting to PDF may leave it recoverable.2
The 30-second test
Run this on any redacted PDF before you send it, and on any you receive:
- Open the PDF and press Ctrl+A (Mac: Cmd+A) to select all text.
- Copy it and paste it into Notepad or TextEdit.
- Look for anything that should have been redacted. Then search the PDF itself (Ctrl+F) for a name you removed.
- Open the document properties and check the author and title fields.
If a redacted word turns up anywhere, the redaction failed.
Methods that actually remove the text
1. A redaction tool that deletes, not covers
Proper redaction tools remove the text and images under each mark, then save a new file. The SANS write-up recommends tools that “delete, not just mask”, and then checking the result.1 Check that the tool also clears metadata and hidden content, not just the visible page.
2. Replace the words before you make the PDF
If you control the source document, replace each detail with a placeholder such as [REDACTED] in Word, remove comments and tracked changes, and only then save as PDF. The DPC suggests placeholders because they also show the reader where something was removed.2
3. Print and scan, as a last resort
Printing the redacted pages and scanning them back in produces a picture of each page with no text layer underneath.1 It works, but the result is not searchable, it is larger, and anything you forgot to cover is now baked into the image. Check every page by eye.
Don’t forget the parts you can’t see
- Metadata: author, company, creation and edit dates in the file properties.
- Comments and annotations: sticky notes and review comments survive inside PDFs.
- Attachments and bookmarks: PDFs can carry attached files and bookmark titles that name people.
- Images: text inside a scanned page or photo is invisible to search; read those pages yourself.2
Redacting for a subject access request?
There is more to a DSAR than the PDF itself: deciding what belongs to other people, keeping a log, and the one-month deadline. Read how to redact documents for a subject access request.
This guide is general information, not legal advice.