Drawing a black rectangle over sensitive text in a PDF does not redact it. I need you to understand this before anything else, because people get fired, sued, and embarrassed over this exact mistake.
A PDF is not an image. When you draw a black box over text, you're adding a new object on top of the text. The text is still there, in the file, in the content stream, fully selectable, copyable, and extractable. Anyone who selects the "redacted" area and pastes it into a text editor gets your secrets. Anyone who runs a text-extraction script gets all of them at once.
This has happened to governments, law firms, and newspapers. It's not a theoretical risk.
The 30-second test
Before trusting any redaction, do this:
- Open the "redacted" PDF.
- Try to select the text underneath a black box with your cursor.
- Copy it. Paste it into a text editor.
If anything pastes, the redaction failed. It doesn't matter what the tool promised. The file is the truth.
For a stronger check, run a text extraction tool over the whole document and search the output for the sensitive terms. If they appear, the content stream still contains them.
What proper redaction actually means
Real redaction has two parts, and both are required:
- Remove the content from the file. The text-showing operations for the sensitive content must be deleted from the page's content stream — not covered, deleted. The bytes should not exist in the exported file.
- Burn the visual mark into the page. The black box should be part of the rendered page content, so the document still reads naturally with visible redaction marks.
If a tool only does step 2, it's a highlighter with bad intentions.
How to do it properly (step by step)
Using PDF Studio (free, runs in your browser, no signup — and relevantly, your document never uploads anywhere, which matters when the document needs redacting):
- Open https://navigatorslab.com/pdf-studio/ and load your PDF. Nothing uploads; everything happens on your machine.
- Select the redaction tool and mark every piece of sensitive text. Marked regions show as a hatched pattern with a dashed red outline labeled "marked for redaction" — that's a promise, not the removal. Be thorough — and don't forget metadata-adjacent content: headers, footers, and text baked into scanned images needs OCR-aware handling.
- Export the PDF — that's when the actual destruction happens, not in the editor. The export clears hidden copies (form values, annotations, structure-tree text) under the marked regions, deletes the vector text operations from the content streams (recursively through Form XObjects), pixel-burns anything it can't provably remove (partial text coverage forces a full-page raster replacement), scrubs metadata/XMP/attachments/JavaScript/actions, and refuses the export entirely if any covered text survives — then burns in the black boxes.
- Verify. This step is not optional. Open the exported file, try the 30-second select-and-copy test on every redacted region. Then run text extraction across the whole document and search for the sensitive terms. They should be absent.
- Check the document metadata too (File → Properties in most readers). Author names and revision history have leaked through "redacted" documents before.
What about scanned documents?
If your PDF is a scan (an image of a page, not real text), there's no text layer to leak — but there's also no text to redact selectively. The safe approach: redact regions of the image itself, so the pixels are destroyed, not covered. Covering part of an image with a black box in a PDF is the same lie in a different format — the underlying image object still contains the original pixels. Make sure your tool destroys the pixels, then verify by extracting the images from the exported file.
The rule
Never trust a redaction you haven't verified. Not from my tool, not from anyone's. The 30-second test takes less time than reading this article. If a tool fails it, stop using that tool for sensitive documents immediately.
PDF Studio redacts by removing content from the file's content stream on export — then invites you to verify it with the test above. Free, MIT-licensed, no server, no signup: https://navigatorslab.com/pdf-studio/
Top comments (0)