Every few months, a news story follows the same script. A government department, a law firm or a large company publishes a document with names, figures or passages "blacked out". Within hours, someone discovers that they can highlight the black boxes, copy the text, and paste the supposedly hidden words into a new document. The redaction was only paint on top; everything underneath was still there.
It happens to careful professionals, and it happens far more often to ordinary people sending a bank statement to a landlord, a payslip to a letting agent or a medical letter to an employer. This guide explains the difference between hiding text and removing it, how to redact a PDF properly, and how to check that your redaction actually worked.
Covering is not redacting
When you draw a black rectangle over text in a PDF editor, a Word document or even a screenshot tool, you add a new object on top of the page. The text underneath is unchanged. Anyone who opens the file can:
- Select and copy the "hidden" text, then paste it elsewhere
- Search the document and find the covered words
- Move or delete the rectangle in an editor
- Extract the text with any PDF-to-text converter, which ignores the rectangle entirely
Highlighting text in black, changing its colour to match the background, or setting it to a tiny font all fail the same way. The words remain in the file.
True redaction does two things: it deletes the text from the document, and then it marks the spot, usually with a black box, so readers can see something was removed. The deletion is the part that matters.
What Redact PDF does
Redact PDF is built around that difference. You type the word, name or number you want gone, and our server:
- Searches every page for that text, ignoring letter case, so "john smith" also finds "John Smith".
- Marks each match for redaction.
- Applies the redactions with PyMuPDF, which deletes the matching text from the page content and fills the area with a solid black box.
- Cleans and rewrites the file, so leftover unused objects are removed rather than hiding in the background.
The result is a new PDF in which the text is gone. It cannot be selected, copied, searched or extracted, because it no longer exists. The file is sent over HTTPS and deleted from the server as soon as the redacted PDF is returned.
How to redact a PDF, step by step
- Make a list of what must go. Account numbers, names, addresses, dates of birth, phone numbers, reference numbers. Write down exactly how each appears in the document.
- Open Redact PDF, choose the file (up to 100 MB) and enter the first term.
- Download the result and use it as the input for the next term. Each run removes one search term everywhere it appears.
- Repeat until every item on your list is done.
- Verify the final file using the checks below.
- Keep the original safe and send only the redacted copy. Redaction cannot be undone.
Think about how the text is written
Because redaction searches for the exact text you type (apart from letter case), variations matter. A single account number might appear as:
| Written as | Needs its own run |
|---|---|
| 12345678 | Yes |
| 1234 5678 | Yes, the space makes it different |
| **5678 or ending 5678 | Search for 5678 |
| 12-34-56 (sort code) | Yes, with the dashes |
Names are similar: "Priya Sharma", "P. Sharma", "Ms Sharma" and "Sharma, Priya" are four different strings. Searching for the surname alone ("Sharma") catches most of them in one run, at the cost of also removing any other Sharma in the document. Deciding which is right depends on the document.
A useful trick: before redacting, open the PDF and use your reader's search (Ctrl+F or Cmd+F) to find each variation. Whatever your reader can find, Redact PDF can remove.
The big exception: scanned documents
Redaction works on the text layer of a PDF. A scanned document or a photo of a page has no text layer, only a picture of text. Searching finds nothing, so nothing is redacted.
For scans, run the file through OCR PDF first. OCR recognises the words in the image and adds a text layer, which Redact PDF can then search. Be aware that OCR is not perfect, especially on poor scans, so verifying the result is even more important. Check each redacted term with a search afterwards, because a misread letter means a missed match.
Signatures, handwriting, photos and logos are images too. If they need to go, redaction by search will not catch them.
How to check that redaction worked
Never trust a redaction you have not tested. Open the redacted PDF and:
- Search for each term with Ctrl+F. It should find nothing.
- Select all the text on a page (Ctrl+A), copy it, and paste it into a plain text editor. The removed words should be absent.
- Try to click or drag the black boxes. They should not move or reveal anything.
- Look at every page, including headers, footers and the last page, where addresses and reference numbers often hide.
If a term still appears, it was written differently from your search. Run the tool again with the variation you found.
Hidden places sensitive data lives
The visible text is not the only place a PDF stores information:
- Document properties. The author name, title, subject and software used are saved in the file's metadata, and redaction does not touch them. Check and clear them with the PDF metadata editor.
- File names. "Statement-Priya-Sharma-acct-12345678.pdf" undoes a careful redaction. Rename before sending.
- Bookmarks and comments. Annotations and bookmarks can contain names or notes. Review them in your PDF reader.
- Earlier versions. Keep the unredacted original somewhere private, not in the same shared folder.
Everyday situations where redaction helps
Proof of income or address for a landlord. They need to see your salary credit or your address, not every purchase you made. Remove card numbers and account numbers first, and consider sending only the relevant pages; our guide to extracting pages from a PDF shows how.
Documents for an employer or HR. A medical letter may need to confirm a condition without revealing every detail.
Sharing contracts as examples. Remove client names and prices before using a real contract as a template.
Publishing documents. Remove personal details of third parties before posting minutes, reports or case studies online.
Sending data to AI tools. Before pasting document text into a chatbot, remove names and identifiers. For text rather than PDFs, the PII Anonymizer replaces names, emails and numbers with placeholders; our guide to anonymising personal data before using AI explains when to use each approach.
After redacting
Once redacted, a document often benefits from a couple of finishing touches. Add a label such as "REDACTED COPY" with Watermark PDF so nobody confuses it with the original. If the remaining content is still confidential, encrypt it with Protect PDF; our guide to protecting a PDF with a password covers choosing and sharing a strong password.
Frequently asked questions
Is the text really removed, or just covered?
Really removed. Each match is deleted from the document and the area filled black, so it cannot be selected, copied or searched.
Can I redact several terms at once?
Each run removes one term everywhere it appears. Run the tool again on the result for the next term.
Can a redaction be undone?
No. That is the point. Keep your original somewhere private in case you need it.
Does it remove the author name and other metadata?
No. Use a metadata tool to clear document properties.
Does it work on scanned documents?
Only after OCR has added a text layer. Scans on their own contain no searchable text.
Redaction is only as good as its weakest step. Remove the text rather than covering it, search for every variation, check the result, and clear the metadata. With Redact PDF and five minutes of checking, the details you meant to hide will stay hidden.
