How to redact a PDF properly, and check that it worked

Why black boxes fail

A PDF page is a list of drawing instructions: put these letters here, draw this image there, fill this rectangle. A black box is just one more instruction, drawn on top. The letters underneath are still in the list, so anyone can select them, copy them, search for them or remove the box. Court filings and government releases with copyable “redacted” text have made the news more than once.

Five places the information survives

1. The text under the box. Still there unless the tool deletes it.
2. Images. On a scanned page the “text” is a picture. A box over a picture hides it; the pixels underneath are untouched unless they’re repainted.
3. The OCR layer. Scans often carry an invisible text layer for search. Redacting the image doesn’t remove that hidden copy of the words.
4. Earlier versions. If the PDF was saved incrementally, the original version, before redaction, is still inside the file and can be recovered.
5. Metadata, notes and bookmarks. The name you redacted can also be the document’s Author, a comment, a bookmark title or a form field value.

How to redact for real

• Preview on a Mac has a Redact tool (Tools › Redact) that removes the selected text when you save. Check the result with the list below.
• Adobe Acrobat Pro has Redact, plus “Sanitize” or “Remove hidden information” for metadata and hidden content. These are part of paid plans.
• Print and rescan is the crude fallback: physically black out, scan again, and you get a picture with no text behind it. You lose searchable text and quality.

Whatever you use: work on a copy, redact, then save in a way that rewrites the whole file (often called “save as”, “sanitize” or “clean save”), never as an incremental save.

Checklist: prove it’s gone

1. Search the saved file for each redacted word or number. Zero results.
2. Select all the text on each redacted page, paste it into a plain text editor and read it.
3. Look at the properties (Author, Title, Subject, Keywords) for the redacted name.
4. Check comments, bookmarks and form fields.
5. On a Mac, count saved versions in Terminal with grep -c "%%EOF" file.pdf; a redacted file should have one (or two if linearized), not several.
6. Try to drag the black box away, or open the file in another viewer.

Redacting a signed document

Redaction changes the page content and the clean save rewrites the file, so any digital signature in it stops being valid. That’s unavoidable. If the recipient needs the signature, ask the signer for a version that leaves out the private details, or send the signed original through a channel where privacy isn’t an issue.