Security

Redact sensitive information in a PDF safely

Why drawing a black box is not redaction, how hidden data survives, and how to test the sanitized copy before sharing it.

Quick answer

Use a real redaction function that removes selected content, then sanitize hidden data and test the exported copy. A black rectangle, highlight, blur, crop, or white shape may only cover information visually while leaving the original text or image recoverable.

01

Covering is not removing

PDF pages can contain separate layers of text, images, annotations, and shapes. Placing a dark rectangle over a name may hide it on screen while the underlying text remains searchable, selectable, copyable, or extractable. Cropping can also leave off-page objects in the file.

Proper redaction marks content for permanent removal and applies that removal to a new output. Sanitization is a related step for information that is not obvious on the page, such as metadata, comments, hidden layers, embedded files, scripts, and previous review data.

02

A defensible redaction workflow

  1. 01

    Define exactly what must leave

    List names, account numbers, contact details, faces, signatures, barcodes, repeated headers, and metadata. Search for repeated text patterns where the tool supports it.

  2. 02

    Work on a controlled duplicate

    Preserve the source separately with restricted access. Mark redactions on the duplicate and review every marked region before applying them.

  3. 03

    Apply redactions and sanitize

    Use the editor’s dedicated redaction command, save to a new file, and remove hidden information. Do not rely on printing to PDF as a universal sanitization method.

  4. 04

    Test like a recipient

    Close the editor, reopen the final copy, search for removed terms, try selecting around each box, inspect document properties, and confirm that comments and attachments are absent.

03

Images require special attention

A name inside a scanned image will not appear in an ordinary text search unless OCR found it. Review every page visually and search the OCR layer as a second method. When removing a face, seal, signature, or code, ensure the redaction covers the complete relevant pixels, including edges and shadows.

Be careful with nearby context. Removing a number while leaving its label, transaction value, and unique date may still identify someone. The correct scope depends on why the document is being shared and which information the recipient genuinely needs.

04

Final verification

  • Search for every exact term and useful partial variants.
  • Select and copy text before, across, and after each redacted area.
  • Check comments, file attachments, layers, form fields, and document properties.
  • Confirm bookmarks and links do not reveal removed information.
  • Ask a second person to inspect high-risk material when policy permits.
  • Share only the sanitized copy and keep it clearly separated from the source.

Final checklist

  • Dedicated redaction tool used
  • Text and image-based instances both reviewed
  • Redactions applied, not merely marked
  • Hidden information sanitized
  • Final copy closed and reopened
  • Removed terms cannot be searched or selected
  • Metadata, comments, and attachments inspected
  • Source and shareable copy clearly separated
Use the interactive checker

?

Questions people ask

Can I redact by drawing a black rectangle?

No. A rectangle may only sit above recoverable content. Use a function explicitly designed to remove and apply redactions.

Does flattening make covered text safe?

Not reliably enough for a general rule. Flattening behavior differs by tool and may preserve text, layers, or metadata. Use redaction and sanitization features, then test the output.

Should I keep the original?

Keep it only when you are authorized and have a secure retention reason. Never overwrite the only source during editing, and do not accidentally share the unrestricted copy.

Primary references

We use primary technical sources where a workflow depends on a specific standard or product behavior.

AP
How this guide was reviewed

Checked against current primary documentation where cited, edited for plain language, and structured around a repeatable verification step. Read our editorial policy.

Continue

Related field guides