How to Redact a PDF Properly (and Check It Worked)

The short answer

To redact a PDF properly, the text, images and drawings under each box have to be removed from the file, not covered. Use a tool that performs real redaction, save a new copy, then test that copy: try to select and copy the hidden words, search for them, and look at the document properties. If any of those shows the hidden text, the redaction failed.

Why black boxes, highlighting and cropping fail

A PDF page is not a picture. It is a list of drawing instructions: put these characters, in this font, at this position; draw this line; place this image here. When you add a black rectangle with an ordinary editor, you add one more instruction to the end of the list. The characters underneath are still in the file, still in order, and still readable by any program that extracts text. The rectangle only changes what a screen or printer paints on top.

That is why these common shortcuts don't work:

Drawing a black box or shape. The text under it can be selected, copied, searched and pasted into another document. Anyone can also open the file in an editor and move or delete the box.
Black highlighting. A highlight is an annotation laid over the page. Changing its colour to black doesn't touch the text it covers, and annotations can be hidden or deleted in most PDF readers.
Cropping. Cropping a page usually changes the visible area (the crop box), not the content. The text outside the crop is still stored and can come back when the crop is removed.
White text, tiny text or text behind an image. Hidden text is still text. Text extraction and search find it regardless of colour or what sits on top.
Redacting in Word, then "saving as PDF". Converting keeps whatever is in the source document, including comments and tracked changes if they weren't removed first. The NSA's guidance on sanitising documents lists covering text with black rectangles or black highlighting among the most common mistakes.

There is one more trap specific to PDFs: incremental saves. Many editors save changes by adding them to the end of the file instead of rewriting it. The earlier version of the page can still be inside, below the new one, and specialised tools can recover it. A redaction tool should write a complete new file.

This happens in real filings

These are not hypothetical problems. A few publicly reported examples:

In January 2019, a court filing by Paul Manafort's lawyers had black boxes over sensitive passages, but the text underneath could be copied and pasted. Reporters read the "redacted" details the same day.
In December 2009, the US Transportation Security Administration posted an airport screening manual online with redactions that could be undone, leading to widespread coverage of how to redact PDFs correctly.
In December 2025, social media users reported that redacted text in some Justice Department documents could be revealed by copying and pasting. Snopes confirmed it for at least one document it examined.

The pattern is the same each time: the page looked redacted, and the file wasn't. The American Bar Association's judges' journal has collected more cases.

What true redaction does

Real redaction changes the file itself. There are two common ways to do it:

Remove the content under each box. Professional PDF editors find the characters, image pixels and vector paths inside each marked area, delete them from the page, and draw a filled box in their place. Text outside the boxes stays selectable.
Flatten the page to an image. The page is rendered as a picture with the boxes painted in, and that picture replaces the original page. Nothing from the old page survives: no text, fonts or vectors. The cost is that the rest of that page is no longer selectable text.

Vault Studio Pro uses the second method. When you save a PDF with redaction boxes, every page that has a box is drawn at 200 dots per inch with the boxes burned in, encoded as a JPEG image, and swapped in for the original page. Pages without boxes are copied across unchanged. The method is blunt, but it is easy to reason about: there is no text left on a redacted page to leak.

Step by step: redacting a PDF in your browser

Work on a copy. Keep the original somewhere safe. You may need it later, and a mistake is easier to fix from the source.
Open the file. Go to the PDF editor in the app and open or drop your PDF. The file is read into the browser tab; it isn't uploaded.
Choose Redact in the toolbar and drag a box over each piece of text or image you need to remove. Make the box a little larger than the text so ascenders and descenders are covered.
Go through every page. Look at headers, footers, page numbers, signatures, stamps, tables, footnotes and the small print. The tool removes what you box. It does not search for names or numbers for you, so repeated details on other pages need their own boxes.
Save PDF. Saving builds a new file. If the document has form fields, they are flattened first, so their values are drawn into the page (and removed with it where you redacted).
Open the saved copy and check it, using the checks below. Don't send the file until it passes.

Because redacted pages become images, text elsewhere on those pages can't be selected any more. If you need the rest of the page to be readable by software, the app's OCR can read the text back so you can copy or search it inside the editor; see our OCR guide.

What we checked in this repository

We didn't want to describe this behaviour without checking it, so the site's test suite runs the app's own Save PDF code on a generated two-page PDF. Page one contains a made-up Social Security number, and the file has a title, author, subject, keywords and an attached text file that also contain it. The test then checks:

A plain black rectangle drawn over the number leaves it fully extractable as text, which is the failure described above.
After saving with a redaction box on page one, page one has no extractable text, the number appears in none of page one's content, and page two still has its selectable text.
The number appears nowhere in the saved file, not even decoded out of a leftover object nothing points to any more, and the file has a single revision (one %%EOF marker) rather than an appended update.
The document's title, author, subject and keywords, its producer and creator fields, and the attached file are all gone from the redacted save: the text fields are cleared, producer/creator are reset to a neutral value, and the attachment's bytes are deleted, not merely unlinked.
A save with no redaction box, and the toggle off, leaves all of that exactly as the original file had it — the stripping only happens on a redacted save, or when you turn it on yourself.

The page image in the test is a placeholder, because the test runs without a real browser canvas; the check is about what the save removes from the file, not how the page looks.

How to check a redacted PDF yourself

These checks take a few minutes and work in any PDF reader:

Select all and copy. On each redacted page, press Ctrl+A (Cmd+A on a Mac), copy, and paste into a plain text editor. None of the redacted words should appear.
Search. Use Find for the exact names, numbers and phrases you redacted, and for fragments of them, such as the last four digits of an account number.
Check the document properties. Open File, then Properties (or Document Properties) and read the title, author, subject and keywords. A redacted save (or a plain save with "Remove metadata before saving" turned on) clears these automatically; if you skipped both and something sensitive is still there, change it in a tool that can edit PDF metadata, then check again.
Look for attachments, bookmarks and comments in your reader's side panels. Attachments are removed by the same redaction/toggle path as the metadata above; bookmarks and comments on pages you didn't redact are not, so check those yourself either way.

For a fuller walkthrough, including command-line text extraction and how to spot incremental saves, read how to check whether a PDF redaction really worked.

Things that live outside the page

Page redaction deals with what is drawn on the page. A PDF can carry sensitive information in other places. Saving with a redaction box (or turning on "Remove metadata before saving" for a save with none) now handles two of these automatically:

Document metadata: title, author, subject and keywords are cleared, and producer/creator are reset to a neutral value, rather than carrying over from the original document.
File attachments embedded in the PDF are removed.

Vault Studio Pro's redaction still leaves the rest alone:

Bookmarks, whose labels may repeat headings you redacted.
Comments and annotations on pages you didn't redact.
The file name itself, which travels with every email.

The app also doesn't verify redactions made by other tools, issue redaction certificates or logs, or add Bates numbers. If your workflow needs Bates numbering, our sister product PDF Vault offers it. Dedicated desktop PDF editors, such as Adobe Acrobat Pro, include a "sanitize" step that removes hidden information along with the redaction.

Common mistakes

Boxing a name on page 3 but missing the same name in a running header on every page.
Redacting the text of a table but not the chart made from it.
Leaving a sensitive value in the document title because it came from the original file name.
Sending the working file instead of the saved, redacted copy.
Pixelating or blurring short text in a scanned image, which can sometimes be guessed. Use solid boxes.
Skipping the check because the page "looks right". Looking right is exactly how the failures above happened.

Redacting well is mostly care and a repeatable check. The tool's job is to make sure what you boxed is really gone. Yours is to box everything that needs to go, and to confirm the saved file before you share it.

Try it

Redaction is part of the free plan. Open a PDF in the PDF editor, pick Redact, draw your boxes and save. Read how PDF redaction works in Vault Studio Pro for the method and its trade-offs, and the security page for what stays on your device.

Open the PDF editor See plans and pricing

Sources

Paul Manafort's lawyers tried—and failed—to redact this sensitive legal filing. Mother Jones, January 2019
In wake of TSA breach, a refresher on redacting PDFs. Nextgov, December 2009
Can Epstein files be unredacted with a simple copy and paste? What we know. Snopes, December 2025
Redacting with Confidence: How to Safely Publish Sanitized Reports Converted from Word to PDF. US National Security Agency, via the Federation of American Scientists
Embarrassing Redaction Failures. American Bar Association, The Judges' Journal
Redact sensitive content in PDFs in Acrobat Pro. Adobe Help Center