Redact a PDF

How redaction works inside a PDF, and why a black box is not it

A page in a PDF is a small program called a content stream. It says things like “select this font at 11 points, move to this position, show the string Smith”, then “paint this image here”, then “fill this rectangle in black”. Text is shown by operators such as Tj and TJ inside a text object, and what is stored is character codes plus a font, so the words remain real, searchable text. A black rectangle is just another instruction later in the list. Nothing earlier is affected.

Real redaction edits the list. For each area you mark, this tool does four things to the page:

1. It removes the text that falls inside the area, so the character codes are no longer in the content stream.
2. It removes or clips vector paths inside the area, such as rules, shapes and table borders.
3. It clears the pixels of any image under the area. The picture stays on the page, but the covered part of it is blank, and the original pixels are not kept anywhere in the file.
4. It draws a solid rectangle in your chosen fill where the content used to be.

The whole file is then written out again from scratch. That matters because a PDF can be saved incrementally, with edits appended after the original data and the older objects left in place. A redaction applied as an appended change would leave the unredacted page sitting in the file. A complete rewrite does not carry the old objects over.

Finally the tool reads the new file back and extracts its text. If any text you removed, or any text that sat inside a box, is still there, the result card says so with a warning instead of a tick. That check is the reason to trust the output more than the preview, and it is still worth repeating by hand with a second program.

What a box actually covers

Boxes are stored as fractions of the page as you see it, so a rotated page or a page whose visible area is smaller than its stored size is handled for you. Boxes made from a search extend a pixel or so past each match and slightly below the baseline so that descenders such as the tails of g, j and y fall inside. If you draw by hand, draw generously: a box that clips the top of a line can leave the lower half of the letters in place.

When to use Redact PDF, and when something else is the right answer

Good fits

• Disclosure and legal bundles. Removing a third party’s name, address or date of birth from a witness statement, a medical record or a tenancy file before it goes to the other side.
• Subject access and freedom of information responses. Taking out other people’s personal data while leaving the rest of a letter or email chain readable.
• Financial paperwork. Hiding an account number and sort code on a bank statement you must send as proof of address or income, while leaving the balance and dates.
• Publishing. Removing a name or a location from a report that goes on a public website.

Better handled another way

• Whole pages. If an entire page should not go, delete it with Organize pages or keep only the pages you want with Extract pages. That is cleaner than boxing a full page.
• A cosmetic cover-up. If you only want to hide a stray scribble and nothing sensitive is involved, the whiteout in Edit and fill is enough, and it says plainly that it does not remove anything.
• Hidden file data. Author names, comments and attachments are not on the page. Use Remove metadata for those.
• Scans with no text layer, when you need to find things. Run OCR PDF first so that searching works, then redact.

One distinction is worth stating directly. Redaction here means deletion from the file, and it is permanent in the copy you download. If you may need the original text again, for example because a court later orders disclosure of the unredacted version, that is a reason to keep the original file carefully, not a reason to avoid redacting the copy.

Searching for text: what is found, what is missed, and how to write patterns

Search reads each page’s text layer, the same layer your reader uses for Ctrl+F. That has three practical consequences.

• Only real text is found. Words inside a photograph, a scan without OCR, or a logo are not text, so they are never matched. The tool tells you when a search finds nothing on what looks like a scanned file.
• Matches run along the page text as it is read. A name broken across two lines has a line break between its parts, so a plain phrase search for the full name will not match it. Use the pattern option and write Jane\s+Smith, where \s+ matches any run of spaces or line breaks.
• Different spellings need different searches. Search the surname alone as well as the full name, plus initials, possessives and any nickname. Capital letters are ignored unless you tick Match case.

The one-click patterns, and their limits

These are conveniences for finding candidates quickly. Read the list before pressing Redact all. The tool lists the first 200 matches on screen and stops collecting at 1,500, saying so if it does; if you reach that limit your search is too broad, so narrow it.

Why your search is also sent to the engine

When you press Redact all, the matches become boxes. The tool also hands the original search to the redaction engine, which is running on your device in the same tab. The engine repeats the search itself over the page contents, so a match that the preview boxed slightly short of the word edge is still removed. Both steps happen locally and neither involves a network request.

Doing it in Acrobat, Preview, Word or Google Docs instead

For a document that began life in Word, the most reliable redaction is often upstream: delete the sensitive words in the source, check the document properties, export a new PDF, and use this tool only on files whose source you no longer have. For PDFs you received, there is no source, and this is the case the tool is for.

Two worked examples with numbers

These use round figures to show how the choices play out. They are illustrations of the arithmetic and workflow, not timing or size benchmarks.

A 60-page disclosure bundle with a witness’s details

A bundle of 60 pages mentions a witness named in 23 places across 17 pages, gives her address on pages 4 and 41, and includes a photograph of her front door on page 29. Search for the surname: 23 matches. Search for the street name: 2 matches. Check the lists, press Redact all after each, and draw one box over the door number in the photograph. That gives 26 areas on 18 pages. Because the surname alone was searched, the possessive “Patel’s” was found as well as “Mrs Patel”.

After applying, the result card reports 26 areas, a few hundred characters deleted and one image with pixels cleared. Search the downloaded file for the surname and for the street name: no results. Then extract everything with PDF to text and read the page 4 and 41 output to confirm no address fragments such as a postcode survive.

A bank statement for a mortgage broker

A 3-page statement shows the sort code and account number in the header of each page. That is six boxes. Use Find text with the pattern option and search the account number digits, which finds all three header copies, then add the sort code the same way. Choose white fill if you want the gap to read as blank space, or black if the recipient should see that something was removed; for anything official, black is the convention.

Limits and edge cases you should know about

• Redaction removes content, not meaning. If a paragraph says “the claimant lives in the only house on the island” and you box only the address, the sentence still identifies someone. Read for context, not just for strings.
• Scans with an invisible text layer. If a scan has an OCR text layer over the picture, both are handled: pixels are cleared and the text under the box is deleted.
• Fonts that map characters oddly. A few PDFs store text with fonts whose character mapping is wrong or missing. Search then shows different letters from the ones on screen, or finds nothing. Draw boxes by eye in that case.
• Vector artwork that spells words. Text converted to outlines in a design program is shapes, not text. Search cannot find it, though boxes clip the shapes.
• Bookmarks, form values, comments and attachments live outside the page. Flatten forms first with Flatten PDF, then clean the rest with Remove metadata. The bookmark panel is worth checking by eye, as bookmark titles often repeat names.
• Signed PDFs. Rewriting a file changes the bytes a digital signature covers, so treat a redacted copy of a signed file as unsigned.
• Device memory. There is no page limit, but a very large file with many images needs memory. A 300-page, 200 MB scan is better handled on a computer than a phone.
• Warnings are real. If the result card shows a warning, for instance that the check could not be completed, do not send the file until you have tested it by hand.

Testing the redacted file before it leaves your hands

Test in a different program from the one that made the file. A short routine takes two minutes.

1. Open the download in your usual reader and press Ctrl+F (Cmd+F on a Mac) for each removed name and number, and for a fragment of each. Expect no results.
2. Press Ctrl+A, copy, and paste into a plain text editor. Scan the text for anything that should be gone.
3. Try to select the text under one of the boxes. Nothing should highlight.
4. Open the document properties and confirm the title, author and subject are empty or harmless.
5. Check the file name. It often contains the very name you removed.

For a stronger test, drop the output into PDF to text, which lists every word the file holds in reading order.

Privacy: the document, the boxes and the search words stay on your device

Redaction is the one job where uploading the file defeats the purpose, because a web service that receives your document has seen the unredacted version before it does anything. Here the page, the preview renderer, the search and the redaction engine all run in your browser tab. No part of the file, no box position and no search term is sent to any server, and the tool does not need an account.

You can check this for yourself: open your browser’s developer tools, watch the Network tab while you open a file and redact it, and you will see no request carrying your document. The verification guide walks through it, including switching your connection off partway through. One honest caveat: the tool’s own scripts and the redaction engine are downloaded the first time you use it, as with any web page, and the download contains nothing from your file.