How to redact a PDF properly

The mistake that has leaked real documents

The failure is common enough that the US National Security Agency published guidance on it in 2005. It named three frequent mistakes when preparing a document for the web: covering text, tables or graphics with black rectangles; covering part of an image with another graphic or shrinking it so it cannot be read; and forgetting the metadata and document properties. All three work on a printed page and fail on a digital one, because what you see is not all that is in the file.

It is not a theoretical problem. In 2009 it emerged that the US Transportation Security Administration had posted its screening operations manual on a procurement website with some passages "redacted"; anyone who copied the document and pasted it into another program, such as Notepad, could read what had been meant to be hidden: settings for X-ray machines and explosives detectors, and procedures for dealing with diplomats, CIA employees and law enforcement officers. Four years earlier, in 2005, a Multi-National Force-Iraq memo about a shooting had been posted with its classified information "blacked out" in the same way. In both cases the text was covered, not removed.

Why a black box is not enough

A PDF is not a photograph of a page. It is a collection of objects: text, images, shapes, annotations. When you draw a black rectangle with most editors, or with the shape tool of an office program, the rectangle is one more object placed on top of the text. Underneath, the text is still text: you can select it, copy it, search it, and sometimes it shows again when you move or delete the rectangle. The same goes for highlighting in black or setting the text background to the same colour as the letters.

And it is not only the page text that matters. A PDF can also carry metadata (author, the program that created it, dates, sometimes the original title), comments and annotations, and layers.

How to check whether a PDF is really redacted

Run this test before sending a redacted document to anyone. It takes thirty seconds:

1. Open the final PDF and press Ctrl+A (Cmd+A on a Mac) to select all the text, then copy it and paste it into Notepad or a blank document. If what you meant to hide shows up, it has not been removed.
2. Use the viewer's search (Ctrl+F) with a word from the redacted detail, such as a surname or the first digits of an ID number. If it finds it, it is still in the file.
3. Open it in a different program from the one you redacted it with, or in the browser, and see whether the detail reappears.
4. Check the document properties. The PDF metadata viewer and remover shows what it carries (author, program, dates) and can clean it.

How to redact for good

The point is that the detail never reaches the file you send. There are two reliable ways:

Turn the redacted page into an image

If the page becomes an image with the box already drawn into the pixels, there is no object to move and no text underneath: what was there is discarded in the conversion. That is what the PDF redaction tool does: you mark rectangles on each page, and pages with boxes are drawn as a high-resolution image with those boxes included, replacing the original page. Pages you do not touch are copied as they were, text and all.

The trade-off is plain: a redacted page loses its selectable, searchable text, as if you had scanned it. If the rest of the document has to stay searchable, redact only the pages that need it. The PDF is loaded, edited and redacted in your browser and never uploaded, which matters when the document is a sensitive one.

Use a professional editor's redaction function

Some paid PDF editors include a dedicated redaction function that really removes the content under the mark. If you have one, it is the most convenient option for long documents. Even so, repeat the copy-and-paste test when you finish.

The NSA method: delete, do not cover

If you have the original (in Word, say), the NSA's advice is to work on a copy, delete the sensitive text rather than covering it, turn off track changes and comments, paste the edited text into a new document, convert it to PDF and review the final output. Always keep the untouched original.

What if what you want to hide is in an image or screenshot

Images behave similarly: a box drawn in a viewer or a presentation tool can be a layer that can be moved or removed. The image redaction tool changes the actual pixels, with a solid colour or pixelation, and downloads the already-flattened result. If you are not sure what appears in a screenshot, the screenshot privacy checker reads the text in the image and flags emails, phone numbers, long numbers or IBANs so you can decide what to cover. It is an aid, not a full review: text recognition can miss small print, rotated text or handwriting, so look at the image yourself too.

One more point about photos: before sharing them, also strip the hidden data in the file, such as the location. That is covered in the guide to removing EXIF data from a photo.

When it is worth redacting

Whenever you send a copy of a document and the recipient does not need to see all of it: a bank statement that only serves as proof, a payslip or contract shared as evidence of income, an invoice with third-party details. Hiding what is surplus is good practice, as long as the recipient accepts a copy like that (some procedures require the full document, so ask first). And in every case the rule is the same: redact for real, and check the final file before you send it.

Sources and further reading

• Nextgov/FCW: In wake of TSA breach, a refresher on redacting PDFs (summarises the NSA guidance, 2009)
• NSA: "Redacting with Confidence" (2005 guidance, copy hosted by the Federation of American Scientists)

Figures checked on 3 October 2026.