Find the personal details in a PDF and remove them

Redaction by hand is the right way to remove something you already know is there. It is the wrong way to answer the question “is anything in these two hundred pages that should not be”, because you have to read all of them, and the one you miss is the one that matters.

This does the finding. It reads the text layer, works out which pieces of it are contact details or identity numbers, and removes those the same way the manual tool does. The glyphs come out of the content stream, not a rectangle over the top.

What it looks for, and how it decides

Seven kinds, each of which can be turned off: email addresses, phone numbers, payment card numbers, US Social Security numbers, Aadhaar numbers, PAN numbers and IBANs.

Every one of them is a shape first and a check second, because shape alone is not enough. A sixteen-digit number is a card number only if it satisfies the Luhn checksum, which roughly nine in ten arbitrary sixteen-digit numbers do not. A twelve-digit number is an Aadhaar only if it satisfies Verhoeff. An IBAN has to satisfy mod-97. An SSN has to be written the way an SSN is written and use an area number that has actually been issued.

That is the difference between a tool you can point at a purchase ledger and one you cannot. Without the checksums, every order number and part number in the document comes out black.

Dates are the other trap. 2024-01-1234 has ten digits and two separators, which are also the structural rules a phone number has, but it is a case reference. So date-shaped strings are excluded, and a run of digits with no country code in front of it is only a phone number at ten or eleven digits, the lengths a phone number actually has.

What it will not find

Names. Street addresses. Account numbers with a house format. Anything whose only signal is meaning rather than shape.

This is worth stating plainly rather than burying. The failure mode of a tool like this is not only a missed finding; it is believing that nothing was missed. If the document has a name you need gone, draw a box over it with Redact a PDF, which removes exactly what you point at and nothing else.

Two more limits. A page with no text layer has nothing to search, so the tool refuses the file and tells you to run it through OCR first. If nothing at all is found, you get a message rather than a file. An identical download is not a result; it is false reassurance with a filename.

The words are removed, not covered

A black rectangle drawn over text is not a redaction. The text is still in the file, and selecting it, searching it or opening it in any other reader gets it back. Everything this tool finds is deleted from the page’s content stream, and any note, form value or link target sitting under the same spot goes with it.

Then the finished file is reopened and read back, because a rewriter that believes it worked is not evidence. If any part of something that was supposed to go is still readable on the page, that page is rendered to pixels instead. This removes its text layer, so the fallback is used only where needed, and the result names every affected page.

The document’s title, author, subject, keywords and producer are cleared too. Those survive a redaction that only touches the page, and they are a well-known leak in filings.

It errs wide, on purpose

A PDF records where a run of text starts and how wide it is. It does not record where each character sits inside that run, so there is no exact way to say “the box goes here, four characters in”.

The first version estimated the match position from the run’s width, its length, and a two-character pad. Against the font’s real metrics, this put the start of a match up to six characters late when narrow and wide letters were mixed. A two-character pad against a six-character error is not a margin; it is a leak.

So the box covers the whole run instead. That needs no estimate and cannot come up short. If the run held only the value, nothing else is affected. Most labelled fields are written this way, with the label and value emitted separately. If the run held the label too, the label goes with it, and the result tells you how many findings did that.

A box a few words too wide is visible, in a file you still have the original of. A box six characters too narrow is an address, most of it still readable, in a file you have already sent.

Nothing leaves the device

The document is read, searched and rewritten by a worker inside your browser. There is no upload, account or server copy. That is the only sensible arrangement for a tool whose entire input is the personal data you are trying to remove.