How to redact a PDF properly — and why most 'redacted' PDFs aren't
Most 'redacted' PDFs you see in the wild aren't actually redacted. The most common mistake is drawing a black rectangle on top of the sensitive text, which hides it visually but leaves the original text intact in the file's underlying data. Anyone with a PDF reader and 30 seconds can copy-paste right through the rectangle and recover the secret. Real redaction permanently removes the data. Here's how to do it correctly.
How real redaction works
We find the text or image regions you've marked, delete the underlying content from the PDF's text streams, and replace the marked area with an opaque mark — usually a black rectangle. After redaction, the bytes that used to contain the sensitive text are gone. Searching for the redacted word returns nothing. Copying from the redacted region returns nothing. Forensic analysis of the file finds no trace.
We also remove metadata associated with the redacted region — author, comments, edit history, and any private data the source application embedded. That step matters: people have been embarrassed when 'redacted' PDFs revealed sensitive content via metadata even though the visible page looked clean.
When redaction is the right step
Specific cases where this is what you need:
- Sharing internal documents with external partners. Strip employee names, salaries, and internal codenames before sending.
- Legal discovery and FOIA responses. Many requests require redaction of privileged or personal info before release.
- Medical records. Patient names, IDs, dates of birth must be removed before any sharing under HIPAA-equivalent rules.
- Financial reports going to investors. Strip names, contracts, and unsigned forecasts.
- Legal filings with redacted exhibits. Court rules require true redaction; 'covered with a black box' filings have been rejected.
Common mistakes
Most 'I thought I redacted that' incidents come from one of these:
- Drawing a black rectangle instead of redacting. Annotation tools draw on top of content. Real redaction tools remove content. Use the redact button, not the highlight or shape tools.
- Forgetting metadata. Names buried in 'Author' or 'Last Modified By' fields survive visual redaction. Always strip metadata in the same pass.
- Forgetting bookmarks and comments. Bookmark text and comment threads can carry sensitive info even when the page itself is clean. Strip both.
- Redacting then editing. Adding annotations after redaction can re-expose redacted content if you accidentally type it. Redact last.
- Trusting visual inspection on text-heavy redactions. Use the search-and-redact mode: search for the sensitive term and let the tool find every instance, including ones you'd miss by eye.
Tips for safe redaction
Habits that prevent leaks:
- Use search-and-redact for names and IDs. Manual redaction misses occurrences. 'Redact every instance of John Smith' uses regex matching to find them all, including in headers and footers.
- Always strip metadata in the same pass. It's a one-click toggle and prevents the most common leak vector.
- Preview the redacted file with copy-paste tested. Open the output, try to copy-paste from a redacted region. If you get the original text back, the redaction failed — don't ship the file.
- Use AI Redact for personal info you might miss. AI Redact auto-detects names, emails, phone numbers, SSN-shaped numbers, and addresses. Run it before manual redaction to catch the obvious cases.
- Save with a clear filename. filename-redacted-2026-04-25.pdf signals 'this version is for sharing'. Keep the unredacted master under a different name.
Limits and compatibility
Free tier: manual redaction on PDFs up to 100 MB. AI auto-detect of personal info: 2 credits per page. Output is standard PDF with redacted regions permanently removed at the byte level. Output passes forensic re-extraction tests in standard tools. Compatible with every major reader and document management system.