Privacy & Security

A black box is not redaction

Why covering text in a PDF doesn't remove it — and what actually works.

Here is a mistake that has embarrassed law firms, government departments, and more than one court filing: someone draws a black rectangle over sensitive text in a PDF, saves it, and sends it out believing the text is gone.

It isn't. The words are still in the file, sitting underneath the rectangle. Anyone can select the blacked-out area, copy it, and paste it into a text editor to read every word.

Why it happens

A PDF is not an image of a page. It's a set of instructions: place this text here, in this font; draw this shape there. When you add a black rectangle, you have added one more instruction to the list. You have drawn a shape on top of the text.

The text instruction is untouched. Your eyes obey the visual result; software doesn't. Copy tools, search indexes, and text extractors read the instructions, not the picture.

The 30-second test. Open your "redacted" PDF. Drag-select across the blacked-out region, copy, and paste into any text box. If the hidden words appear, your document is not redacted — and it never was.

The same mistake in other clothes

Several common techniques fail for exactly the same reason:

The common thread: hiding is not removing. Real redaction deletes the underlying content.

What actually works

You have two reliable options.

1. Use a true redaction feature. Some professional PDF software has a genuine redaction tool that removes the underlying text rather than covering it. If you use one, apply the redaction — many tools require an explicit "apply" step, and skipping it leaves the text intact.

2. Flatten the page into an image. This is the blunt, reliable method, and it needs no specialist software. If you convert the page to an image, the text instructions are destroyed — all that remains is a picture of the page. There is no text layer left to copy out.

The practical workflow:

  1. Cover the sensitive text with a solid black box, as you normally would.
  2. Convert the page to an image (PNG). The text layer is discarded in the process.
  3. Convert the image back into a PDF.
  4. Strip the document's metadata, which can still name the author, the software, and the original filename.

The result is a document where the covered text genuinely no longer exists in the file.

Do it without uploading anything

Every step above runs inside your browser on PDFRange. A document you're redacting is exactly the kind of file that should never be uploaded to someone else's server.

PDF to image Image to PDF
One trade-off, worth knowing. Flattening removes the text layer for everyone — including screen readers and search. For a document that must stay accessible or searchable, use a true redaction tool instead, or re-run OCR on the flattened file afterwards so the remaining text is readable again.

Don't forget the second layer

Redaction failures often come in pairs. A document can be perfectly redacted on the page and still disclose its author, employer, editing times, and original filename through its metadata. If the reason for redacting was confidentiality, finish the job: strip the metadata before the file leaves your machine.

The short version

If you can still select it, it isn't redacted. Cover, flatten, clean, then check by trying to copy the text yourself.

Thirty seconds of checking is considerably cheaper than the alternative.

Explore the private PDF toolkit →