PDF Redaction: How to Permanently Remove Sensitive Information
True PDF redaction permanently removes content from the underlying page stream — unlike covering text with a black box, which leaves the original data intact. This guide explains the technical difference, how to redact correctly in Acrobat and open-source tools, and how to verify that redaction is complete.
Redaction is the process of permanently removing sensitive information from a document before it is shared. In the world of PDF, this sounds straightforward — but it is one of the most commonly misunderstood operations in document handling, with failure modes that have caused significant legal and compliance embarrassments for governments, law firms, and corporations worldwide.
The fundamental misconception: placing a black rectangle over text in a PDF does not remove the underlying text. The original content remains in the PDF's page stream, invisible to the eye but fully accessible to anyone who opens the file in a text editor, copies and pastes, or uses a PDF analysis tool. True redaction requires permanently removing the underlying data from the file — not covering it.
This guide explains how PDF redaction works technically, how to perform it correctly, how to verify it, and what tools are available for both individual documents and high-volume redaction workflows.
Why black boxes are not redaction
When a user draws a black-filled rectangle over text in a PDF viewer or adds a black annotation box, the visual result looks redacted — the text is invisible. But the PDF's internal structure is unchanged. The underlying content stream still contains the text drawing operators, and the black box is rendered as an overlay on top of them.
This has caused real-world redaction failures:
- In 2005, the Associated Press extracted unredacted text from a Pentagon report on the killing of Italian agent Nicola Calipari by removing the "redacted" boxes in an Adobe Acrobat file.
- In 2009, a court filing by attorneys for NSA whistleblower Thomas Drake exposed sensitive programme names by a similar mechanism — black annotations over unredacted text.
- In 2021, a law firm filed documents in Ghislaine Maxwell's case containing supposedly redacted names that were trivially extractable.
These failures share the same root cause: black-box covering instead of true content deletion. The PDF data leak prevention guide covers this and related failure modes in detail.
How true PDF redaction works
True PDF redaction involves three steps:
1. **Mark**: Identify the regions to be redacted — by text search, visual selection, or pattern matching (regex for SSNs, credit card numbers, etc.).
2. **Apply**: Remove the marked content from the PDF's underlying page streams. This means modifying the content stream operators to delete or replace the text or image data, not simply covering it. The redacted area is typically replaced with a solid filled rectangle in the output.
3. **Sanitise**: Remove all other possible locations where the sensitive data might persist — metadata, comments, bookmarks, form field values, document attachments, thumbnails, and JavaScript.
After applying redaction, the output PDF should contain no trace of the removed content in any layer of the file. Verification by extracting text from the output file and searching for the redacted strings is essential.
Note that redaction of text in an image-based scanned PDF requires a different approach — since the text is part of the raster image, the image pixels themselves must be overwritten. OCR-identified text coordinates can be used to locate and overwrite the appropriate pixel regions.
Redaction in Adobe Acrobat Pro
Adobe Acrobat Pro provides a purpose-built Redact tool (Tools > Redact). The workflow:
1. Use "Mark for Redaction" to select text or regions. Acrobat highlights them for review before applying.
2. Use "Find & Redact" to locate text by keyword or pattern across all pages — useful for names, ID numbers, or dates.
3. "Apply Redactions" permanently modifies the page content streams and replaces marked areas with filled rectangles.
4. After applying, use "Sanitize Document" to remove metadata, embedded content, scripts, and hidden data that might contain the redacted information.
A critical step that many users miss: **always sanitise after applying redactions**. Applying redactions modifies page content but does not automatically clean metadata or other data stores. Sanitize Document is a separate step.
Acrobat's redaction tool also supports marking redacted text with a custom label (e.g., "[REDACTED]", "[PRIVILEGE]") which appears in the filled rectangle in the output — useful for legal documents where the fact of redaction must be acknowledged.
Open-source and programmatic redaction
Several open-source and programmatic tools support true PDF redaction:
**qpdf**: Does not directly redact content, but its --flatten-annotations and content stream manipulation capabilities can be used in a redaction pipeline. qpdf is best used for post-processing after content deletion.
**PyMuPDF (fitz)**: The Python binding for MuPDF supports page content redaction: page.add_redact_annot(rect) marks a region, page.apply_redactions() removes the underlying content and fills with a solid colour. Supports text search-based marking.
**Apache PDFBox**: Java library with support for redaction via content stream modification. The PDFBox Cookbook includes redaction examples.
**Ghostscript**: Can be used to rasterise pages — converting the PDF to an image-only PDF which eliminates all text data. This is a "nuclear option" that makes the PDF inaccessible to screen readers but guarantees text extraction is impossible.
For high-volume redaction (legal discovery, FOIA requests), commercial tools including Relativity, Nuix, and Everlaw provide AI-assisted pattern identification across large document sets.
Verifying that redaction is complete
After redacting and sanitising, verification is essential. Steps to verify:
1. **Text extraction**: Use a text extractor (pdftotext, PyMuPDF, or the copy-paste function in any PDF reader) and search the extracted text for the redacted strings. If any appear, the redaction failed.
2. **Metadata inspection**: Use Acrobat's Document Properties, ExifTool (exiftool -all file.pdf), or the metadata inspection workflow to check all metadata fields.
3. **Annotation inspection**: Check that no annotation (comment, sticky note, markup) contains the redacted content. Acrobat's Comments panel shows all annotations.
4. **Attachment inspection**: Check for embedded files or portfolios that might contain unredacted versions.
5. **Bookmark and outline inspection**: Bookmarks can contain text that references redacted content — verify the bookmark tree is also sanitised.
For legally sensitive redactions (court filings, FOIA responses, M&A due diligence), consider having a second reviewer perform the verification independently before release.
True PDF redaction is a multi-step process — mark, apply, sanitise, verify — not a single operation. Every step must be completed, and the output must be verified before distribution. The consequences of a redaction failure range from regulatory violations and legal sanctions to reputational damage and harm to the people whose information was supposed to be protected.
Use our PDF redaction tool for browser-based redaction that permanently removes content without server upload.
Frequently asked questions
Why can I still see text under black boxes in some PDFs?
Black boxes that are semi-transparent (partial opacity annotation) or that are drawn as annotations rather than as page content can sometimes be seen through. More importantly, even opaque black boxes leave the underlying text in the PDF's content stream — it is invisible but extractable. Select all and copy (Ctrl+A, Ctrl+C) on a page with black-box "redaction" and paste into a text editor — you will often see the supposedly hidden text appear in the pasted output. True redaction requires removing the text from the content stream itself.
What is the difference between redaction and whiteout in PDF?
Whiteout (painting over content with a white rectangle or applying a white box annotation) hides content visually but leaves it in the PDF — identical in vulnerability to black-box covering. Redaction removes the underlying content from the page stream permanently. For any document requiring genuine privacy protection, only true redaction is appropriate. For cosmetic correction of mistakes visible only on screen, whiteout may be acceptable — but never for sensitive content.
Does redaction work on scanned PDF images?
Text in a scanned PDF is stored as pixels in a raster image — there is no separate text layer to delete. To redact scanned PDFs: (1) use OCR to identify the text locations if needed; (2) overwrite the image pixels in the redaction region with solid fill at the image resolution. PyMuPDF and Acrobat Pro both support pixel-level image redaction. However, be careful with high-resolution scans — zooming in on a redacted area can sometimes reveal ink impressions from the original text if the redaction fill is not a complete overwrite of the pixel region.
How do I redact PDF form field data?
PDF form fields can store data independently of the page content stream — in the field value dictionary. A redaction that only modifies the page content stream will not remove the data stored in the field's value. To fully redact form field data: (1) apply page content redaction to remove the rendered field value from the page display; (2) flatten the form (convert fields to static content) to eliminate the field dictionary; (3) sanitize to remove any remaining field data from the AcroForm dictionary. Acrobat's Sanitize Document handles this as part of the full sanitisation pass.
Can I undo a PDF redaction after applying it?
No — by design, applied PDF redaction is irreversible. Once you apply redactions and save the file, the content is permanently removed from the page stream. This is the point of redaction. Always keep an unredacted copy of the original document in a secure location before applying redactions, and work on a copy rather than the original. If you accidentally redacted the wrong content, restore from the backup copy and redo the redaction process.
Try it yourself
Everything in this article can be done directly in the free PDFTheGuide editor — no account required.