It is one of the most expensive mistakes people make when handling documents: Someone opens a PDF, draws a black rectangle over a name with the highlighting tool, saves it, and sends the file. It looks redacted. It is not.
The reason lies in the structure of the format. A PDF is not an image of a page, but a list of instructions: Place this font here, draw this rectangle over it. Both instructions remain in the file. The rectangle only covers the text when viewed. For a program that reads the file rather than displaying it, the text is still there unchanged.
How to prove it in thirty seconds
Open a supposedly redacted PDF in any viewer, select the area with the black bar, and copy it. Paste it into a text editor. If the allegedly removed text appears there, and that is the usual case, the redaction was ineffective.
Search works the same way: Ctrl+F in the viewer finds words that are under the bars. This is also a reliable test.
The case that made it widely known: In 2019, Paul Manafort's lawyers filed a court document with redacted passages. Journalists selected the bars, copied out the text, and read what was meant to remain hidden. The process involved a law firm and a court, both experienced in handling confidential documents.
What actually works
There are exactly two ways for content to truly disappear from a PDF file.
- The page is turned into an image. The page is rendered, the areas are redacted in the image, and the original page, including its text layer, is replaced. Afterward, there is no text left there that could be extracted, including no hidden text.
- The text is removed from the file. A tool intervenes in the list of instructions and deletes the relevant text commands. This is more elegant because the page remains searchable, but it is technically complex and prone to errors, especially with documents that have an unusual structure.
The first method comes at a cost: The affected pages are no longer searchable afterward, and the file becomes larger. In return, you can check at a glance whether it worked, if there is no text left at all, none can be copied out either.
The trap when checking
If you check the redaction yourself, you should run a second test. Not being able to copy text anymore only means there is no text layer left. It does not mean that nothing readable remains in the image.
This can happen if the bar is shifted by a single character: The first letter of a name remains visible, or the last digits of a number stick out. Everything is fine for the text check, but not for the human eye. So look at the result before sharing it, at full size.
A second, tougher test: Run the redacted document through text recognition. It reads the image and finds what a person could read. If it does not produce anything confidential, the redaction has held up.
What else may be in the file
Visible text is not everything. A PDF file can also contain:
- Metadata - author, title, software used, often the original file name along with its folder path.
- Comments and notes that are collapsed in the viewer.
- Previous versions. If a PDF is saved multiple times, some programs append the changes instead of rewriting the file. Older versions remain.
- Form fields containing content that is not visible.
- Embedded files, such as spreadsheets attached to the document.
There is a simple countermeasure for the last point: Have the file rewritten once more after editing it. Repairing rebuilds the structure from the ground up and leaves out anything that is no longer referenced.
Before sending
- Select and copy text from a redacted area, if nothing appears, the text layer is gone.
- View the document at full size, does anything remain visible at the edge of a bar?
- For particularly sensitive documents: Run them through text recognition and search the result.
- Check metadata and remove it if necessary.
Our redaction tool uses the first of the two methods: It finds personal data, shows it to you for confirmation, and then replaces the affected pages. Anything you deselect remains. And anything that is redacted is no longer in the file afterward, not merely no longer visible.