How to Redact Sensitive Information From a PDF Properly

Redaction means permanently removing information so it cannot be recovered — not just hiding it. This distinction has caused real-world disasters, where "redacted" court filings and reports were de-redacted in seconds because the underlying text was still there.

The mistake everyone makes

Drawing a black rectangle over text in a regular PDF editor, or changing the text colour to black, does not remove anything. The original text still exists in the file and can be revealed by selecting it, copying it, or removing the box. True redaction must delete the content itself.

How to redact in PDFelly

Open the Redact tool and add your PDF.
Mark the areas you want removed.
Apply the redaction and download the cleaned file.

Doing this locally is especially important: the document you are redacting is, by definition, sensitive. It should never be uploaded to a third party as part of hiding its secrets.

Verify before you share

Try to select the redacted area. If nothing can be highlighted or copied, the content is gone.
Check metadata. Author names and titles can leak information; consider flattening the file too.
Watch hidden layers. Comments, form fields and annotations can carry data — remove them as well.

For images and scans

When the sensitive content is part of a scanned image, the safest approach is to rasterise the page so the redacted pixels are physically replaced. Always do a final read-through of the output before sending it anywhere.

Real-world redaction failures

The reason redaction deserves its own careful workflow is that getting it wrong has repeatedly leaked sensitive data — court filings, intelligence reports and corporate documents where a black box was placed over text that was still fully present underneath. Anyone who copied the page, or simply moved the box, recovered the "hidden" content instantly. The lesson is simple: hiding is not removing.

A safe redaction checklist

Before sharing a redacted file, run through a short check. Try to select and copy text in the redacted area — if anything comes back, the content is still there. Search the document for a word you redacted; it should not be found. Review document metadata and any comments or annotations, which can carry the very information you removed from the page. When in doubt, rasterising the affected pages physically replaces the pixels and removes any lingering text.

Why this must stay on your device

You only redact documents that contain something sensitive. Uploading such a file to a remote redaction service to hide its secrets is self-defeating — the unredacted original passes through someone else's infrastructure. Redacting locally means the sensitive version never leaves your machine.

Frequently asked questions

Why isn't drawing a black box enough?

A black box only covers text visually; the underlying text remains in the file and can be copied or revealed. True redaction removes the content itself.

How do I confirm redaction worked?

Try to select and copy the redacted area and search for the removed words. If nothing is selectable or found, the content is gone.

Does redaction remove metadata?

Page redaction targets page content. Check and clear metadata, comments and annotations separately, or flatten the file.

Is my sensitive document uploaded?

No. Redaction runs entirely in your browser, so the unredacted file never leaves your device.

Building redaction into a safe sharing habit

The most dependable way to avoid a redaction disaster is to make verification part of the routine rather than an afterthought. Treat every redacted document as guilty until proven clean: after marking and applying the redactions, deliberately try to defeat your own work. Select across the blacked-out regions and attempt to copy; search the file for the exact words you removed; skim the metadata and any comments for stray copies of the same information. Only once all of those come back empty should the file leave your hands. For documents where the stakes are high — anything legal, medical or financial — go further and rasterise the affected pages so the sensitive pixels are physically replaced, leaving nothing recoverable underneath. Keeping the unredacted original in a secure location lets you redact differently later if a new request comes in, without having to reconstruct the document from scratch.

Related guides

Try it now: Redact PDF — free, private, runs entirely in your browser. No upload, no account.