How to redact a PDF so the text is really gone

This is not an obscure edge case. A PDF page is a list of drawing instructions executed in order. "Put the word Hendricks at x=180, y=420" is one instruction. "Fill a black rectangle over that area" is a later instruction. The second one paints over the first on screen. It does not erase it from the list.

Things that look like redaction and are not

Note the blur row. Pixelation of a short, known-format string, a name, a licence number, a postcode, is reversible in principle: an attacker pixelates candidate strings the same way and looks for a match. Never blur. Use solid, opaque black.

The reliable browser method

The idea is simple: make the sensitive area invisible, then destroy the entire text layer by turning every page into a picture of itself. Once a page is an image, there is nothing to select, extract or search, including the words that were under the box.

1. Work on a copyDuplicate the file first, for example report-REDACTED-WORKING.pdf, and keep the original in a separate folder. Never redact your only copy.
2. Cover every sensitive area with solid blackUse any editor or annotation tool to draw filled, fully opaque rectangles. Overlap generously: extend past the ends of the words and cover descenders. A sliver of a letter left visible is enough to narrow a name.
3. Check every page, not just the obvious onesNames recur in headers, footers, contents pages, bookmarks and appendices. Search the whole document for each term before you move on.
4. Rasterise the pagesConvert the marked-up file to images with PDF to JPG at 200 to 300 DPI. Below 200 DPI the printed result looks soft; above 300 the file grows fast with little visible gain.
5. Rebuild the PDF from the imagesUse JPG to PDF to reassemble the pages in order. The new file has no text objects at all, so the covered words are genuinely gone.
6. Strip the metadataRun the new file through remove metadata. Titles and keywords frequently contain the same names you just redacted.
7. Verify before it leaves your machineDo the checks in the next section, every single time. A redaction you have not verified is not a redaction.

Verifying that it worked

Four checks, one minute, on the final file you are about to send. Run all four.

1. Select all and paste. Open the redacted file, press Ctrl+A then Ctrl+C, and paste into a plain text editor. On a correctly rasterised file, nothing is selectable and nothing pastes. If you get a wall of text, the text layer survived, stop and start again.
2. Search for a redacted term. Press Ctrl+F and type one of the names you removed. Zero results is the expected answer. A hit means the word is still in the file even though you cannot see it.
3. Extract the text on the command line. Run pdftotext redacted.pdf - and read the output, or pipe it to grep for the removed terms. This bypasses the viewer entirely and is the check that catches everything.
4. Check the file size. A rasterised document is usually larger than the text original. A file identical in size to the original means the rasterising step never ran.

# The definitive check: extract raw text and search it
pdftotext redacted.pdf - | grep -i -e "hendricks" -e "07700 900" -e "@example.com"

# Expect no output. Any line here is a leak.

The desktop alternative

Adobe Acrobat Pro has a true redaction feature and it is the right tool for volume work. It is a two-stage operation and people get caught by stage two: Redact → Mark for Redaction only marks the areas, and the content is not removed until you press Apply. A file saved between those two steps still contains everything. After applying, run Sanitize Document as well, which removes metadata, hidden layers, attachments and scripts in one pass.

What redaction still does not cover

• Metadata. Title, Author and Keywords are separate from the page content and survive rasterising in some pipelines. Always run a metadata pass afterwards.
• Inference. Redacting a name but leaving a job title, a date and a department can identify a person as surely as the name did. Redact the identifying combination, not just the obvious field.
• Consistency across a set. If the same person is redacted on page 4 and left visible on page 30, the redaction on page 4 achieved nothing. Search the whole set for every term.
• Attachments and embedded files. A spreadsheet attached inside the PDF is not part of any page and is not rasterised. Check the attachments panel and remove them.

Covering is not removing, and the only proof of removal is failing to extract the text. A watermark or stamp solves a different problem entirely.

Frequently asked questions