How to Redact a PDF Properly (Why Black Boxes Fail)

Drawing a black box over text does not redact it. In most PDF editors the box is just a shape on top of the page, and the text underneath is still there to copy, search or extract. Proper redaction deletes the content under the box. Redact PDF does this in your browser, and Remove hidden data cleans metadata afterwards.

Why black boxes fail

A PDF page is built in layers: text, images, shapes and annotations. When you use a highlighter or rectangle tool and colour it black, you add a new layer on top. On screen it looks redacted. In the file, nothing has changed underneath.

Anyone who receives that file can:

• Select and copy the text under the box and paste it somewhere else.
• Search for a word and see it highlighted under the black bar.
• Delete or move the box in any PDF editor.
• Extract the text with a PDF-to-text or PDF-to-Word converter.

This is not a theoretical risk. In 2019, lawyers for Paul Manafort filed a court document in which the “redacted” passages could be copied out from under the black boxes, revealing details they meant to hide (American Bar Association). The US National Security Agency published a guide, Redacting with Confidence, because the same mistake kept happening. Its core point: information that’s only covered can usually be recovered. It has to be removed.

The same applies to:

• Black highlighting in Word before saving as PDF. The text is exported with the highlight on top.
• Changing the text colour to white or black. The text is still there.
• Covering text with an image or sticker in an editor.
• Cropping a page. Cropped content is often kept in the file, just hidden from view.

How true redaction works

Real redaction changes the file itself, not just how it looks:

1. The content under each box is deleted — text, images or vector drawings, not just covered.
2. The black box is burned into the page, so it can’t be removed to reveal anything.
3. The deleted text doesn’t come back when you search, copy or convert the file.

Redact PDF does this by rebuilding each page that has a redaction as an image with the black boxes burned in. The hidden text no longer exists in that page. Pages without redactions are kept as they are, so their text stays selectable.

How to redact a PDF with PDFToast

1. Open Redact PDF.
2. Add your PDF. It stays on your device.
3. Tick the details it finds automatically, such as emails, phone numbers, Aadhaar, PAN and card numbers.
4. Search for any other words or names you want gone.
5. Tap Redact & download.
6. Run the checks below on the downloaded file.

The free plan includes one redaction a day. For a single Aadhaar copy, Mask Aadhaar is a quicker option that covers the first 8 digits.

Redaction checklist

Before you redact:

• Work on a copy. Keep the original somewhere safe and private.
• Know what must go: names, ID numbers, account numbers, addresses, signatures, phone numbers, emails, photos of faces.
• Look beyond the main text: headers, footers, page numbers that include names, tables, charts, stamps and handwritten notes.
• Check images. A scanned page is a picture. Text search won’t find words in it unless you run OCR first, so draw boxes manually.

After you redact:

• Select all and copy (Ctrl+A / Cmd+A, then paste into Notes or a text editor). The removed text must not appear.
• Search the PDF for each removed word or number. There should be no results.
• Convert it with PDF to Text. The removed content must not show up.
• Zoom in on every box to make sure it fully covers the area, including descenders like g, p and y.
• Check the file name. “Rahul_Sharma_salary.pdf” gives away what you redacted.
• Clean hidden data (next section).

Don’t forget metadata and hidden data

Even a perfectly redacted page can leak through the rest of the file. PDFs often carry:

Hidden item	What it can reveal
Document properties (title, author, subject, keywords)	Your name, the original title, the client’s name
Creator and producer software	Which program and computer made the file
Comments and annotations	Reviewer notes, sometimes quoting the removed text
Attachments	Whole original documents embedded in the PDF
Form field values	Data typed into fields that’s still stored
Scripts	Code that runs when the file is opened
Bookmarks	Section names that mention what was removed

To clean them:

1. Open Remove hidden data and add your redacted file.
2. Choose what to remove: metadata, comments, attachments, scripts and form data.
3. Download. The visible pages stay the same.

If the document has filled-in form fields you want to keep visible but locked, Flatten PDF turns them into fixed page content. To see what properties a file has before sharing it, open PDF metadata.

When to redact vs when to just protect

• Redact when the other person should never see the information, for example sharing a contract with an account number removed, or a court filing.
• Password-protect with Protect PDF when the right person should see everything, but you want to keep it from others.

Many documents need both: redact what nobody needs, then password-protect the result before emailing it.

Keep the original private too

Redaction is usually for your most sensitive files: IDs, medical records, legal papers, bank statements. Uploading them to a server-based PDF site to redact them defeats part of the purpose. PDFToast runs in your browser, so the original never leaves your device. Here is how to check any PDF site in 30 seconds.