How to Redact a PDF (Remove Sensitive Info)

Redacting a PDF means permanently removing sensitive information from it, not just hiding it. The critical thing to understand up front: drawing a black box over text does not redact it, because the original text stays in the file underneath and can be recovered in seconds. True redaction, the kind the redact PDF tool performs, deletes the underlying content and then covers the gap, so there is nothing left to recover. Because the tool runs entirely in your browser, the confidential document is never uploaded anywhere.

This guide explains the difference between real and cosmetic redaction, why it matters so much, how to redact text and images correctly, why you must also clear metadata, and why doing it all in your browser is the only safe way to handle sensitive documents.

The single most important thing about redaction

If you take away one point from this guide, make it this: a black rectangle drawn on top of text is not redaction. It looks like redaction, the words are hidden behind a black bar, but the original characters are still in the PDF, fully intact, sitting beneath the shape. Anyone who receives the file can recover them trivially:

• Select the text under the box and copy it into another document.
• Delete the black rectangle in any PDF editor and read what was underneath.
• Run text extraction or search on the file and pull out every “hidden” word.

This is not a theoretical risk. There is a long, embarrassing history of organizations leaking exactly this way: courts publishing filings where redacted names could be copied out, agencies releasing documents whose black bars peeled away to reveal Social Security numbers, and companies exposing confidential terms in supposedly redacted contracts. In each case, someone applied cosmetic redaction, a black box, and assumed the data was protected when it was one click from exposure.

True redaction is different. It removes the actual content, the text characters or the image pixels, from the file, and then places a solid block where the content used to be. The visible result looks identical, a black mark, but underneath there is nothing left. That is the difference between a genuine privacy protection and a data breach in waiting.

True redaction vs cosmetic redaction

Here is the distinction laid out plainly.

	Cosmetic (black box)	True redaction
What it does	Draws a shape over the text	Deletes the content, then covers the gap
Underlying data	Still in the file	Removed from the file
Recoverable?	Yes, trivially	No
Safe to publish?	No	Yes
Looks redacted?	Yes	Yes

The danger is that both look the same on screen. You cannot tell a safely redacted document from a dangerously fake one just by looking, which is exactly why so many leaks happen. The only way to be safe is to use a tool that performs true redaction, like redact PDF, rather than a generic editor where you draw a rectangle and hope.

Why redaction matters: real-world stakes

Redaction is not a niche feature. It is a legal and ethical requirement in many situations, and getting it wrong has real consequences.

• Legal discovery and court filings. Litigants must disclose documents but redact privileged content, third-party personal data, and irrelevant sensitive material. A botched redaction can waive privilege or expose people who were never party to the case.
• Freedom of information (FOIA) requests. Government bodies releasing records to the public must redact exempt information, such as personal data and security details, before publishing. Failed redactions on public portals are a recurring source of breaches.
• Privacy regulation compliance. Laws like the EU’s GDPR, US healthcare’s HIPAA, and Indonesia’s UU PDP impose strict duties to protect personal data. Disclosing an unredacted national ID number, an Indonesian NIK, a US SSN, a patient record, or a financial detail can mean regulatory fines and mandatory breach notifications.
• Business confidentiality. Sharing a contract, a financial report, or a board document with an outside party often requires redacting commercially sensitive figures, trade secrets, or the identities of other clients.

In every one of these cases, a cosmetic black box does not just fail, it creates a false sense of security that makes the eventual leak worse. The point of redaction is that the data is gone, not merely hidden.

How to redact a PDF properly (step by step)

Here is the full process using the free redact PDF tool. It runs in your browser, so there is nothing to install and the confidential file is never uploaded.

1. Save an unredacted original first. Before you touch anything, keep a separate copy of the original document in your own secure files. True redaction is irreversible, so this is your only way back if you redact the wrong thing.
2. Open the tool. Go to the redact PDF tool in any modern browser. The document is read locally and displayed.
3. Mark the sensitive content. Drag to select the text, numbers, or image regions you need to remove, names, ID numbers, account details, faces, signatures, anything sensitive. Mark every instance on every page; sensitive data often repeats in headers, footers, and tables.
4. Apply the redaction. Confirm the marks. The tool deletes the underlying content and replaces each marked area with a solid block, so nothing remains beneath the mark.
5. Clear the metadata. Remove or overwrite the document’s hidden properties, the author, title, software, and dates, so identifying information does not leak through the file’s background data (see the next section).
6. Flatten the document. Flattening strips interactive layers and annotation data, ensuring there are no residual editable elements. Use the flatten PDF tool for this final lock-down.
7. Verify before sharing. Open the redacted file and try to select, copy, and search for the content you removed. It should be completely gone. Also check the file’s properties to confirm the metadata is clean.
8. Save and share the redacted copy. This new file is your safe-to-distribute version. Keep your unredacted original separate.

That is the whole process. No account, no watermark, and the confidential document never leaves your machine.

Redacting text, numbers, and images

Redaction is not only about words. Sensitive information hides in several forms, and all of them need attention.

• Text and numbers. Names, addresses, Social Security and national ID numbers, account numbers, dates of birth, and email addresses are the most common targets. Remember that the same value often appears more than once, in a header, a signature block, a reference line, so search the whole document, not just the obvious paragraph.
• Images and photos. A scanned ID card, a photo of a person, a signature image, or a screenshot can all carry sensitive content. Redact the image region just as you would text; the pixels must be removed, not covered.
• Tables and forms. Spreadsheet-style tables embedded in a PDF can hold rows of personal data. Redact each sensitive cell.

If your document is a scan, the text is an image rather than selectable characters. You can still redact by marking the image regions, but if you want to be sure no machine-readable text survives, that is another reason to confirm the file does not have a hidden OCR text layer. If it does, that layer must be redacted too, not just the visible image.

Do not forget the metadata

Visible content is only half the story. Every PDF carries hidden metadata that redaction of the page does not touch:

• Author and creator names (often a real person or an organization).
• Title and subject fields, which sometimes contain a sensitive file name.
• Creation and modification dates, which can reveal a timeline.
• Producing software and, in some cases, leftover comments or keywords.

A document can have every visible name blacked out yet still announce its author in the file properties, or reveal when it was last edited. Proper redaction therefore always includes clearing or overwriting this metadata. After redacting the content, strip the metadata and then flatten the PDF to remove any remaining interactive or annotation data. Finally, open the file’s properties to confirm nothing identifying is left in the background.

Redaction is irreversible, and that is the point

Because true redaction deletes the underlying content, you cannot get it back from the redacted file. This is a feature, not a flaw: it is precisely what makes the document safe to publish. The practical implications are simple but important:

• Always keep an unredacted original in your own secure storage before you redact. The redacted file is a one-way derivative.
• If you make a mistake, you start over from your saved original rather than trying to “undo” the redaction.
• Treat the redacted file as the public version and the original as the private master.

Think of it like shredding a paper document after photocopying the page with the secrets blacked out: the copy is safe to share, but the shredded original is gone. That irreversibility is what distinguishes redaction from merely hiding.

Locking and protecting the redacted file further

Once a document is redacted, you may want to control who can open or change it. Two tools help. The flatten PDF tool, already part of the workflow above, removes editable layers so the redacted file cannot be tampered with. For an extra layer, the protect PDF tool lets you set a password so only intended recipients can open the file, which is sensible when emailing a redacted document that still contains some confidential, non-redacted content. If you need to make broader edits to the document, such as removing whole sections or rearranging pages before distribution, the edit PDF tool covers that, though always redact sensitive content with the dedicated redact PDF tool rather than relying on editing alone.

Why redacting in your browser protects your privacy

This is the part that matters most for redaction specifically, and where many online tools fail in the most ironic way possible. A lot of “free redaction” websites upload your document to a server to process it. Stop and consider what that means: to redact a confidential document, they first send an unredacted copy, with every sensitive detail still in it, to a third party’s infrastructure. The original, complete with the data you are trying to protect, now exists on someone else’s servers. For the single most sensitive category of document you handle, that is the worst possible place for it to be.

The documents people redact are exactly the ones that must never leak:

• Legal files under discovery or privilege.
• Financial records with account and balance details.
• Medical documents protected by HIPAA.
• Anything with ID numbers, an SSN, a NIK, a passport number.

The redact PDF tool avoids the problem by design. The document is read from your disk into your browser’s local memory, redacted there, and the clean file is generated on your own device. Nothing, redacted or unredacted, is transmitted over the network or stored remotely, and the file is gone when you close the tab. There is no account and no watermark. For sensitive documents this is not merely a convenience; it is the only approach that does not expose the very data you are trying to remove. If you want the broader reasoning, see our overview of in-browser PDF tools with no upload and our guide to a privacy-first PDF workflow.

Common use cases

• Legal discovery. Redact privileged content and third-party personal data from documents before producing them, keeping the unredacted originals secure.
• FOIA and public records. Remove exempt personal and security information before publishing government records, without uploading them to a third party.
• Sharing financial reports. Black out account numbers, salaries, and client names before sending a report to an outside party.
• Healthcare records. Redact patient identifiers from medical documents to comply with HIPAA before sharing for research or referral.
• Protecting your own ID. Remove your NIK, SSN, or passport number from a scanned document before emailing it.

Troubleshooting and limitations

A few honest caveats so you know what to expect:

• I can still copy the “redacted” text. Then it was covered, not removed. Use the redact PDF tool’s true redaction, which deletes the content, rather than drawing a shape over it.
• The file properties still show my name. You redacted the page but not the metadata. Clear the document properties and flatten the PDF, then re-check the properties.
• I redacted the wrong thing. Redaction is irreversible. Start again from the unredacted original you saved before beginning.
• My scanned document has a hidden text layer. If the scan was run through OCR, the recognized text must be redacted too, not just the visible image. Confirm and redact that layer.
• Sensitive data appears in several places. It often does, in headers, footers, and repeated references. Mark and redact every instance across all pages.

Conclusion

Redacting a PDF properly means permanently removing sensitive content, not hiding it behind a black box that anyone can lift. Use a tool that performs true redaction, deleting the underlying text and images, clear the document’s metadata, and flatten the result so nothing editable remains. Keep an unredacted original for your records, because real redaction is irreversible by design. Most importantly, because the redact PDF tool runs entirely in your browser, you can redact legal, financial, and medical documents without ever uploading the sensitive data you are trying to protect.

Ready to redact safely? Remove sensitive information now with the free, no-upload redact PDF tool.

Frequently asked questions

Related articles