How to Redact a PDF Properly
Drawing a black rectangle over text does not remove it — the words are still in the file. Here’s how improper redaction leaks data, and how to redact a PDF so the content is actually gone.
Improper PDF redaction is one of the most repeated data-leak mistakes in the world — it has exposed informant names in court filings, salaries in published reports, and personal details in government documents. The cause is almost always the same: someone drew a black box over text and assumed the text was gone. It was not.
This guide explains why that happens and how to redact a PDF so the sensitive content is genuinely removed from the file.
The redaction mistake that keeps leaking data
A PDF is a layered document. The text lives in one layer; anything you draw on top — a shape, a highlight, a black rectangle — sits in another. Covering text with a black box changes what you see, but the original characters are still sitting underneath in the file.
Anyone can recover them. Select the page and copy — the “hidden” text lands on the clipboard. Or open the PDF in an editor and delete the box. The words were never removed; they were merely hidden behind an image.
Why a black box doesn’t remove anything
- Annotations sit on top of content. A drawn rectangle is an overlay; the text layer beneath it is untouched.
- Copy-paste ignores visuals. Text extraction reads the character data directly, straight past any shape covering it.
- Metadata and hidden layers persist. Author names, comments, and earlier revisions can linger even when the visible page looks clean.
What proper redaction looks like
True redaction deletes the underlying content, not just hides it. After redacting a region, the characters and image data in that area must be removed from the file so there is nothing left to copy, recover, or undo. The black mark you see afterwards is a result of the deletion, not a sticker over live text.
PDFGee’s PDF redactor performs this true “black-box” deletion, and it does it entirely in your browser — so a document you are redacting precisely because it is sensitive is never uploaded to a server in the process.
How to redact a PDF properly
- Open the PDF redactor and load your document. It stays on your device.
- Draw a redaction region over each piece of sensitive content — names, numbers, signatures, anything that must not be recoverable.
- Apply the redaction so the content under each region is deleted, not just covered.
- Export the redacted PDF as a new file. Keep the original separately if you still need it.
- Verify (see the checklist below) before you send the file anywhere.
Redact a PDF properly → Content is deleted, not covered — and nothing is uploaded.
A 60-second verification checklist
Never trust your eyes alone. Before sharing a redacted PDF, confirm:
- Try to select the text in the redacted areas. Nothing should be selectable or copyable.
- Copy the whole page into a text editor. The redacted words must not appear.
- Search the document for a name or number you redacted — it should return no match.
- Check the metadata for author names or comments that might re-expose the source.
If anything sensitive is still recoverable, it has not been redacted — it has been hidden. Worried a file you received might be improperly redacted? You can check a PDF for recoverable “redacted” content too.
Frequently Asked Questions
Why is text still readable under a black box in my PDF?
Because drawing a black box only adds a shape on top of the text — the original characters remain in the file’s text layer and can be selected, copied, or revealed by deleting the box. Proper redaction deletes the underlying content instead of covering it.
How do I redact a PDF so the text is actually removed?
Use a tool that performs true redaction, which deletes the content within the marked region rather than overlaying it. PDFGee’s PDF redactor does this in your browser, then exports a new file with the content gone.
Is it safe to redact sensitive documents in an online tool?
Only if the tool processes the file locally. PDFGee redacts entirely in your browser, so the document — which is sensitive by definition if it needs redacting — is never uploaded to a server.
How can I be sure my redaction worked?
Verify it: try to select and copy the redacted areas, paste the page into a text editor, and search for the redacted terms. If nothing sensitive is recoverable, the redaction is real.