Find the personal details in a PDF and remove them

Redaction by hand is the right way to remove something you already know is there. It is the wrong way to answer the question “is anything in these two hundred pages that should not be”, because you have to read all of them, and the one you miss is the one that matters.

This does the finding. It reads the text layer, works out which pieces of it are contact details or identity numbers, and removes those the same way the manual tool does — the glyphs come out of the content stream, not a rectangle over the top.

What it looks for, and how it decides

Seven kinds, each of which can be turned off: email addresses, phone numbers, payment card numbers, US Social Security numbers, Aadhaar numbers, PAN numbers and IBANs.

Every one of them is a shape first and a check second, because shape alone is not enough. A sixteen-digit number is a card number only if it satisfies the Luhn checksum, which roughly nine in ten arbitrary sixteen-digit numbers do not. A twelve-digit number is an Aadhaar only if it satisfies Verhoeff. An IBAN has to satisfy mod-97. An SSN has to be written the way an SSN is written and use an area number that has actually been issued.

That is the difference between a tool you can point at a purchase ledger and one you cannot. Without the checksums, every order number and part number in the document comes out black.

Dates are the other trap. 2024-01-1234 has ten digits and two separators, which is every structural rule a phone number has, and it is a case reference. So date-shaped strings are excluded, and a run of digits with no country code in front of it is only a phone number at ten or eleven digits — the lengths a phone number actually has.

What it will not find

Names. Street addresses. Account numbers with a house format. Anything whose only signal is meaning rather than shape.

This is worth stating plainly rather than burying, because the failure mode of a tool like this is not that it misses something — it is that you believe it did not. If the document has a name you need gone, draw a box over it with Redact a PDF, which removes exactly what you point at and nothing else.

Two more limits. A page with no text layer has nothing to search, and rather than report such a file clean the tool refuses and tells you to run it through OCR first. And if nothing at all is found, you get a message rather than a file — a download that is identical to what you uploaded is not a result, it is a false reassurance with a filename.

The words are removed, not covered

A black rectangle drawn over text is not a redaction. The text is still in the file, and selecting it, searching it or opening it in any other reader gets it back. Everything this tool finds is deleted from the page’s content stream, and any note, form value or link target sitting under the same spot goes with it.

Then the finished file is reopened and read back, because a rewriter that believes it worked is not evidence. If half of something that was supposed to go is still readable on the page, that page is rendered to pixels instead — which costs it its text layer, so it is done only where it is needed, and the result tells you exactly which pages it happened to.

The document’s title, author, subject, keywords and producer are cleared too. Those survive a redaction that only touches the page, and they are a well-known leak in filings.

It errs wide, on purpose

A PDF records where a run of text starts and how wide it is. It does not record where each character sits inside that run, so there is no exact way to say “the box goes here, four characters in”.

The first version of this estimated it — the run’s width divided by its length, times the offset of the match, plus a pad of two characters. Measured against the real metrics of the font, that estimate put the start of a match up to six characters late on text mixing narrow and wide letters. Two characters of padding against a six-character error is not a margin; it is a leak.

So the box covers the whole run instead. That needs no estimate and cannot come up short. Where the run held only the value, nothing else is affected — which is most labelled fields, because a writer usually emits the label and the value separately. Where the run held the label too, the label goes with it, and the result tells you how many findings did that.

A box a few words too wide is visible, in a file you still have the original of. A box six characters too narrow is an address, most of it still readable, in a file you have already sent.

Nothing leaves the device

The document is read, searched and rewritten by a worker inside your browser. There is no upload, no account and no server copy — which is the only sensible arrangement for a tool whose entire input is the personal data you are trying to remove.