How to properly redact a PDF

Redaction removes information, not just appearance

A PDF page is a stack of instructions and resources. Text, images, vector shapes, annotations, form values, attachments, metadata, and optional layers can coexist even when only one visual result appears on screen. Drawing a black rectangle adds another instruction near the top of that stack. It does not automatically delete what was drawn earlier.

That is why a black box can fail. A recipient may select and copy the hidden words, search for them, extract them with a library, remove the rectangle in an editor, or inspect the underlying content stream. Changing the fill to white has the same problem. Taking a screenshot can remove selectable text, but it may reduce quality, destroy accessibility, leave secrets elsewhere in the document, and create new metadata. It is not a complete redaction procedure.

FileGizmo’s Edit PDF tool includes a Cover object for visible corrections. It is explicitly not a redaction feature. The project did not ship /pdf/redact because the current browser stack cannot guarantee removal of arbitrary text and image content inside a region without unsafe whole-page rasterization or incomplete stream rewriting.

What a proper PDF redaction workflow must do

First, mark the exact content to remove. The selection may be text based, region based, or both. Text selection helps find repeated names or numbers; region selection is necessary for signatures, faces, diagrams, handwritten notes, and scanned pages.

Second, apply the redactions so the underlying page content is destroyed or replaced. A trustworthy tool distinguishes marking from applying. Until application finishes, the original content may still exist. Save the applied result as a new file, never over the only source copy.

Third, sanitize information outside the visible page. Review document properties, author and company fields, comments, hidden layers, form values, embedded files, links, bookmarks, scripts, thumbnails, revision remnants, and OCR text behind scans. The exact list depends on the document and tool. “Remove hidden information” is a separate step in some professional applications.

Fourth, verify independently. Do not rely only on the same visual view that created the redaction. Open the result in another current reader and test the data boundary.

A practical verification checklist

1. Search for every removed name, account number, phrase, and distinctive fragment.
2. Select all page text, copy it into a plain-text editor, and inspect the result.
3. Run an independent PDF-to-text extractor and search its output. FileGizmo’s PDF to Text tool can help with ordinary selectable text, but no single extractor covers every PDF representation.
4. Try selecting around each black region. Check whether a cursor or copied text reveals hidden words.
5. Inspect comments, annotations, form fields, bookmarks, layers, and attachments.
6. Review document properties and metadata for names, paths, software details, or identifiers.
7. Zoom into every region and inspect neighboring content for clipping, partial characters, or exposed pixels.
8. Confirm page count and order, then have a second person review high-risk documents.

Keep a written checklist for repeated organizational work. Redaction failures often happen because someone applied boxes but skipped extraction or metadata review.

Scans and images require a different threat model

In a scanned PDF, the visible words may be pixels inside a page image. OCR can add a hidden selectable text layer behind that image. Covering the pixels may leave the OCR text, while deleting OCR text alone may leave the visible pixels. Proper redaction must address both representations.

Images can also contain more than the visible crop. A clipping path may show only part of a larger embedded image. If a workflow merely changes the crop or places a shape above it, hidden pixels may remain recoverable. A specialist redaction engine should rewrite or replace the affected image resource, not just cover its display area.

Whole-page rasterization is sometimes used as a fallback because it can remove structured text. It has serious costs: lost searchability and accessibility, larger files, degraded vector graphics, and the possibility of preserving secrets in metadata, attachments, or an OCR layer added later. Use it only as part of an approved procedure, not as a universal shortcut.

Avoid common redaction mistakes

Do not use a highlighter with black colour. Transparency or blend modes may reveal the text. Do not use comments, drawing annotations, or removable shapes. Do not assume printing to PDF sanitizes the file. Printer drivers differ, and unrelated hidden information may survive.

Do not crop the page to hide a margin containing sensitive information. PDF crop boxes often change the visible viewport while retaining content outside it. Do not replace a few characters with spaces in a visual editor unless the tool explicitly removes the original data and the result passes extraction tests.

Do not email the source and the redacted copy together. Use clear filenames, separate working and release folders, and verify that the attachment selected for sending is the final reviewed file.

Treat redaction as a release process

For legal discovery, public-records disclosure, medical records, financial documents, personnel files, national-security material, or documents governed by an organization’s policy, follow the mandated tool and review steps. The relevant authority may require audit logs, named reviewers, particular software, or retention of an unredacted master in controlled storage.

Password protection is not redaction. Encrypting a PDF controls opening when the password remains secret; an authorized recipient can still see everything. FileGizmo’s Protect PDF tool can add AES-256 password encryption locally, but it does not remove content or substitute for access policy.

The correct product promise is narrow: FileGizmo can visually cover non-sensitive content during ordinary editing, and it refuses to call that secure redaction. When confidentiality matters, use a purpose-built redaction tool, apply the marks, sanitize hidden data, and verify the result with independent extraction and human review.