Redaction failure is one of the most reliably recurring document mistakes there is. Court filings, government reports, regulatory submissions and corporate contracts have all been published with sensitive material that anyone could recover by selecting the blacked-out area and pressing Ctrl+C. The organisations involved were not careless amateurs — they were law firms and government departments with document professionals on staff.
The mistake is always the same, and it comes from a reasonable misunderstanding of what a PDF is. This guide explains what is actually happening, and how to redact a document so the information is genuinely removed rather than merely hidden.
Why black boxes are not redaction
A PDF page is not an image of a page. It is a set of layered instructions: draw this text, in this font, at these coordinates; draw this image here; fill this rectangle with black. A PDF reader executes those instructions in order and shows you the result.
When you use an annotation or drawing tool to place a black rectangle over a name, you have not deleted the instruction that draws the name. You have added a new instruction, executed afterwards, that fills a rectangle with black. Both instructions are still in the file. The reader draws the name and then paints over it — visually, the name is hidden; structurally, it is exactly where it was.
The text is recoverable by anyone who wants it, using no specialised tools at all — copy and paste, an automated text extractor, or simply removing the annotation layer, which many PDF editors will do in one click because annotations are designed to be removable.
The four ways redaction fails
Cosmetic black boxes are the most common failure but not the only one. These four account for essentially all real-world redaction leaks:
| Failure | What was done | How it leaks |
|---|---|---|
| Cosmetic covering | A black rectangle, highlight, or image placed over the text | Copy and paste; removing the annotation layer |
| Layer deletion only | The visible text object removed, but not the page's text stream | Text extraction tools still find it |
| Metadata left behind | Page content redacted, document properties untouched | Author, original filename, revision history, comments |
| Reversible flattening | Content flattened but the document retains an undo or revision history | Prior versions recoverable from the file's incremental saves |
The last one deserves particular attention because it is invisible. PDFs support incremental saving: when a file is edited, the changes can be appended to the end rather than the whole file being rewritten. That means a document may contain its own earlier versions. If you redact a name and the editor saves incrementally, the pre-redaction version can still sit in the file, complete and readable, below the version you see.
What real redaction does
Genuine redaction removes the content rather than obscuring it. A correct implementation performs several distinct operations:
- Deletes the underlying content objects. The text characters, image data or vector paths in the redacted region are removed from the page's content stream — not covered, removed.
- Draws an opaque marker in their place. Usually a black rectangle, so the reader can see that material was withheld. This is the part everyone gets right; it is meaningless without the step above.
- Rewrites the file completely. The output is written as a fresh PDF rather than appended to the original, which eliminates incremental-save history and any recoverable earlier version.
- Strips associated metadata. Document properties, embedded comments, form field values and attachments are cleared, because sensitive data hides in all of them.
Redact a PDF in four steps
Redacting with PdfDocShift removes the underlying content rather than covering it, and writes a clean output file. There is no installation and no sign-up, and uploads are permanently deleted from our servers after two hours.
Work from a copy
Duplicate the original file before you start and store the original somewhere access-controlled. Redaction is irreversible, and the moment you need to check what was under a black box, you will need that copy.
Open the Redact PDF tool
Go to pdfdocshift.com/redact-pdf and upload your document. Read through the whole file first rather than redacting as you go — sensitive details repeat in headers, footers, footnotes and appendices far more often than people expect.
Mark every region to remove
Drag a box over each piece of content to be removed. Extend the marks slightly past the visible edges of the text: a character that pokes out from under a mark can be enough to narrow down a name or a number. Check every page, including ones that look like boilerplate.
Apply and download
Apply the redactions and download the result. The tool deletes the underlying content, draws the marks, and writes a fresh file with no incremental history. Then verify it — the next sections cover how.
Redact a document properly
Free, no sign-up, files deleted after 2 hours. Content is removed, not covered.
Open Redact PDF →The part everyone forgets: metadata
You can redact every page perfectly and still leak the thing you were trying to protect, because a PDF carries a substantial amount of information that never appears on any page.
- Author and creator fields. Usually the name of whoever's software licence produced the file — frequently a named individual at a named firm.
- Original filename. Often retained in document properties.
Smith_termination_draft_v3.pdftells a reader a great deal before they open a page. - Creation and modification timestamps. Establish when a document existed, which can matter enormously in litigation and disclosure.
- Comments and annotations. Review notes and tracked changes travel with the file and are not part of the visible page.
- Form field values. A completed form may retain entered values in its fields even when the visible rendering has been redacted.
- Embedded attachments. PDFs can carry entire files inside them — spreadsheets, other PDFs — with no visible indication on any page.
Before releasing a redacted document, flatten it with Flatten PDF to convert form fields and annotations into static page content, and check the document properties in any reader. If the file is going to an adversarial party — opposing counsel, a regulator, a journalist — assume every field will be examined, because it will be.
Redacting scanned documents
Scanned documents present the opposite problem, and the counterintuitive part is that they are safer by default. A pure scan is an image: there is no text layer, so a black rectangle drawn over it, once flattened into the image, genuinely removes the pixels.
The danger arrives when the scan has been through OCR. Running OCR adds an invisible text layer beneath the image so the document becomes searchable — and that text layer is unaffected by anything you draw on the image above it. A scanned contract that has been OCR'd and then redacted with a drawing tool is exactly as leaky as a native PDF, with the additional hazard that it looks like a safe image-only file.
How to verify a redaction actually worked
Never release a redacted document without checking it. Verification takes about a minute and catches every common failure:
- Select and copy. Open the redacted file, select all the text on each redacted page (Ctrl+A or Cmd+A), copy it, and paste into a plain text editor. Search the pasted text for the terms you removed. Nothing should appear.
- Search the document. Use the reader's find function to search for a redacted name or number. A cosmetic redaction will still highlight a match — behind the black box.
- Check the properties. Open document properties and read the author, title, subject and keyword fields. Confirm no original filename or individual's name survives.
- Compare file sizes. A properly redacted file is normally slightly smaller than the original, because content was deleted. A redacted file that is noticeably larger suggests material was added on top rather than removed — a strong hint the redaction is cosmetic.
- Have someone else check it. For anything genuinely consequential, the person who did the redaction is the worst person to verify it. They know where the marks are and will look at exactly those places.
If the document is being released to a limited group rather than published, consider adding a password with Protect PDF as a second layer. It is not a substitute for correct redaction — encryption protects a file in transit, not its contents once opened — but it limits casual redistribution of a document that was only ever meant for a few people.
Frequently asked questions
No, and this is the single most common document-security mistake there is. A black rectangle is a graphic drawn on top of the page; the text underneath remains in the file and can be recovered by selecting and copying the area, by any automated text extractor, or by deleting the annotation layer. Real redaction deletes the underlying content objects and rewrites the file.
Open the redacted file, select all the text on the page, copy it, and paste it into a plain text editor. Search for the information you removed. If it appears, the redaction is cosmetic. Also use the reader's find function to search for redacted terms — a cosmetic redaction will still match behind the black box — and check the document properties for author names and original filenames.
Correct redaction cannot be undone, and that is intentional — a reversible redaction is one an adversary can reverse. The content is deleted from the file rather than hidden. Always work from a copy and keep the unredacted original stored securely, because there is no way to recover the removed content from the redacted output.
It depends on whether the scan has been through OCR. A pure image scan has no text layer, so marks flattened into the image genuinely remove the pixels. But if OCR has been run, there is an invisible text layer beneath the image that drawing tools do not touch — and such a file looks like a safe image-only scan while leaking exactly like a native PDF. Try selecting text on the page to find out which you have.
Not automatically, and this is a frequent oversight. Author names, the original filename, creation timestamps, comments, form field values and embedded attachments all live outside the visible page and survive page-level redaction. Flatten the document to convert annotations and form fields into static content, then check the document properties before release.
It is safe when the tool encrypts uploads in transit and deletes files promptly. PdfDocShift uses 256-bit SSL for every upload and permanently deletes files from its servers after two hours. For material under a protective order or equivalent restriction, check your own organisation's rules first — some require that privileged documents are processed only on controlled systems, regardless of a provider's safeguards.
Redact your document safely
Free, no sign-up, files deleted after 2 hours. Underlying content is removed, not covered over.
Open Redact PDF →