Guides ·
A black box over text does not redact a PDF
Why drawing a rectangle over a name leaves the name in the file, how to check whether a document you have been sent is leaking, and what actually removes text.
No. A black rectangle is a graphic drawn on top of the page, and the text underneath it is still in the file — selectable, searchable and recoverable by anyone who copies and pastes. Redaction has to remove the text, not cover it.
The one-sentence version
A PDF is not a picture of a page. It is a set of instructions, and one of those instructions says “draw this text here”. Adding a second instruction that says “draw a black rectangle here” does not delete the first one. Both are in the file. The rectangle is on top when the page is displayed, and that is the only sense in which the text is hidden.
Select the area and copy it. The text comes out.
How to check a document in ten seconds
If someone has sent you a PDF with blacked-out sections, this tells you immediately whether it is leaking:
| Check | What it means |
|---|---|
| Select across the black area, copy, paste into a text editor | If words appear, the redaction is cosmetic |
| Press Ctrl+F and search for a name you expect to be hidden | A hit inside a redacted area means the text is still there |
| Open the document in a browser and use “Save as text” | Everything the text layer contains, black boxes ignored |
| Drag the black rectangle in a PDF editor | If it moves, it was only ever a shape on top |
Any one of those finding text means the document should not be circulated. This is not an obscure technique — it is copy and paste.
Why it keeps happening
The failure is not that people are careless. It is that every tool most people have makes the wrong thing easy and the right thing hard.
The highlighter and shape tools in the common PDF readers draw annotations. An annotation is an object layered over the page, designed to be added and removed without altering the document underneath — which is exactly the right behaviour for a comment and exactly the wrong behaviour for a redaction. The tool is working correctly; it is simply not a redaction tool.
Worse, the result looks finished. The words are invisible on screen, the document prints correctly, and nothing anywhere warns that the text is still present. There is no visible difference between a document that has been properly redacted and one that has not, which is why the mistake survives review by people who are being careful.
It has produced a long line of public embarrassments: court filings, government disclosures and corporate submissions where the covered names were recovered within minutes of publication by readers doing nothing more sophisticated than selecting the text.
What actually removes text
There are only two approaches that genuinely work, and they trade off against each other.
Remove the text objects from the content stream. The precise, structural answer: find the text drawing operations inside the marked area and delete them. Everything else on the page — the other text, the fonts, the images — is untouched, and the document stays selectable and searchable everywhere you did not redact. It is also the harder of the two to get right, because text in a PDF is positioned by a series of transformations rather than by coordinates you can read off, and a partially removed run can leave fragments behind.
Rasterise the marked pages. Render the page to an image, draw the redaction onto the pixels, and replace the page with that image. Nothing survives, because there is no longer a text layer on that page at all. It is blunt: the page stops being selectable, searchable and accessible to a screen reader, and the file usually gets larger. But it is very difficult to get wrong, and “difficult to get wrong” is the property that matters most when the cost of failure is a leaked name.
The redaction tool here takes the second approach, and only on the pages you actually mark — pages you do not touch keep their text layer intact. That is a deliberate trade: certainty on the pages that matter, and no unnecessary damage to the rest of the document.
The other thing that leaks
Removing the text is necessary but not sufficient. A PDF carries information that is not on any page:
- Document metadata — title, author, the software that produced it, and the creation and modification dates. The author field of a “anonymous” submission is a well-worn way of identifying its source.
- Earlier revisions. PDFs support incremental saving, where changes are appended to the end of the file and the previous version is left in place above them. A document edited and saved this way can contain its own unredacted history.
- Attachments and embedded files, which are not visible on any page.
- Comments and annotations from the review process.
If a document genuinely matters, check its metadata separately after redacting it. The two problems are unrelated and fixing one does not touch the other.
A working method
- Redact with a tool that removes or destroys the text rather than covering it.
- Reopen the finished file and try to select the redacted areas. Copy, paste, look.
- Search the document for the names and numbers that were supposed to be gone.
- Check the metadata for author, title and producer.
- Only then send it.
Step two is the one people skip, and it takes about five seconds. Every public redaction failure would have been caught by it.
Why this one runs in your browser
The documents that need redacting are, definitionally, the ones that should not be uploaded to a stranger’s server: court bundles, medical records, HR files, contracts under negotiation, disclosures with third-party names in them.
Sending a document to a web service to have names removed from it means the service receives the document with the names still in it. That is a strange trade for a privacy operation, and it is why the tool here does the work inside your browser — the file is read by the page and never leaves your device. You can watch the Network tab stay empty while you use it.