How to Redact a PDF Properly (and Permanently)

Redaction means permanently deleting content so it cannot be recovered by any method — not covered up, but removed. In a PDF, sensitive information can live in several places at once: the visible text and graphics on the page, an invisible text layer on scanned documents, embedded images, and metadata stored inside the file's structure.

The test is simple. After redaction, the words, numbers, or pictures you removed should no longer exist anywhere in the file. If someone opens the PDF in a text editor, runs a search, copies the page, or inspects the raw bytes, the protected content must return nothing. Anything less is concealment, not redaction — and concealment reliably fails.

The most dangerous error is treating redaction as a visual task. A black rectangle over a name, a black highlighter, text recolored to match the background, or an opaque image pasted on top all look convincing on screen. Underneath, the original text is intact — select the page, copy it, and the hidden words paste straight into any text editor.

This is not theoretical. In January 2019, Paul Manafort's lawyers filed a U.S. federal court document whose blacked-out text could be read by copying and pasting it, exposing details the defense meant to keep sealed. In December 2009, the U.S. Transportation Security Administration posted its airport screening manual online with redactions that could be stripped away to reveal sensitive procedures. Agencies, firms, and corporations repeat the mistake constantly — almost always because a box was drawn instead of the data removed.

Proper redaction is a delete operation, not a paint operation. A real redaction tool removes the actual characters, vectors, and image pixels in the marked area from the underlying content stream, then draws a black bar over the now-empty space. The PDF standard (ISO 32000) even defines a dedicated redaction annotation, but that annotation only marks content for removal — the data survives until you apply the redaction as a separate, destructive step.

The visible page is only part of the job. The same information can hide in document metadata, comments, form-field values, bookmarks, embedded scripts, attachments, hidden optional-content layers, image EXIF data, and — most dangerously — an invisible OCR text layer on scanned pages. Any one of them can leak what you thought you removed.

Use software with a dedicated redaction feature — one that marks content and then applies it destructively. Generic editors that only let you draw shapes are not enough. The workflow holds for any genuine redaction tool: mark what to remove, then apply the marks to delete it for good.

For scanned pages, or whenever you need maximum certainty, rasterizing the redacted pages — flattening each one to a plain image — strips any lingering text layer, at the cost of making the page text non-selectable.

Never trust that redaction worked just because it looks right. Verification takes about a minute and catches exactly the failures that cause breaches. If any of these checks surfaces content you removed, the redaction failed and the file is not safe to share.

Three hidden sources cause most leaks once the visible page is clean. First, metadata: the document-information dictionary and XMP packet can store the author, the original title, and keywords — sometimes the exact text you redacted. Second, incremental saves: a PDF saved repeatedly appends new data without dropping the old, so earlier versions survive inside the file until a clean 'Save As' to a fresh file discards them.

Third, and most overlooked, is the OCR layer. On scanned pages an invisible, searchable text layer sits behind the image, so a black box over a scanned name still leaves it searchable and copyable unless the text layer itself is removed.