A PDF with a failed redaction looks exactly like a PDF with a good one. The rectangle is on the page, the account number is not visible, and nothing in the software tells you the digits are still in the file. That is the entire problem: the failure is invisible at the moment you are checking for it.
Most tools that offer redaction draw a rectangle. A PDF is a list of drawing instructions carried out in order, and a rectangle is one more instruction added at the end. It covers the words on screen. It does not take them out of the list. Anything that reads the file rather than looking at it gets the original text back — a text extractor, a search box, a screen reader, or a cursor dragged across the black.
You cannot see this failure. That is why it keeps happening to careful people.
Check a file you have already sent
Start with the ones already out of your hands, not the next one. None of this needs a tool you do not have, and none of it requires you to trust us.
- Open the redacted PDF in any reader. Drag the cursor across the black rectangle as though selecting text, copy, and paste it into a notes app. If letters appear, the redaction failed.
- Press Ctrl+F, or Cmd+F on a Mac, and search for the word you removed. A file that still holds it will find it, underneath the box.
- For the thorough version, put the file through a text extractor and read everything it produces. Our PDF to Text does this in the browser; any offline extractor you already have does it too.
If any of the three brings the words back, the file leaked when you sent it. Replacing the box now does not undo that — the copy people already have still holds the text. Redo the redaction from the original, and check the new file before it goes anywhere.
The check that looks technical and gives a false pass
The tempting expert move is to search the raw file: run grep over the PDF for the account number, or strings, and conclude it is clean when nothing comes back. Do not rely on that. Page text is normally compressed inside the file, so the characters are not lying around as readable bytes. A document that still holds every letter comes back silent.
Decompressing is not enough either. PDFs commonly store text as hexadecimal — the letters written out as pairs of digits — so a search for the word finds nothing while the word is entirely present. Our own test for this had to decompress the streams and decode the strings before it could tell a real removal from a decorated one. A search that finds nothing is not the same as a file that contains nothing.
What actually removes text
One thing: deleting the characters from the page's instruction list, so there is nothing left to find. The black box can still be drawn afterwards, because a redacted page ought to look redacted — but at that point the box is decoration and the removal has already happened.
This is also the reason a redaction tool should tell you how many characters it took out. A number is something a rectangle cannot produce.
The parts a redaction does not reach
- A scan has no text to delete. The page is a picture of words, so there is nothing in the file to remove. A box does genuinely cover them, but the original pixels can still sit underneath it — export the page as an image, paint over the area there, and rebuild the PDF from that.
- Comments, form fields and reusable blocks are stored separately from the page's instruction list. A tool that rewrites that list, ours included, does not touch them. It is one more reason the check belongs after the redaction rather than instead of it.
- The document's own properties are separate again: title, author, the software that made it, and the dates. None of that is printed on any page. Clear it afterwards with the metadata remover, which is a different job from taking words off a page.
- If you flattened the file or printed it to a new PDF at some point, run the check on that output too rather than assuming the step removed anything.
What our tool does, and where it stops
Redact PDF deletes the text objects under each box from the page's content stream, then draws the box, and reports how many characters were removed. It runs entirely in your browser, which matters more here than on any other tool we have: a redaction service that first takes a copy of your unredacted document has been handed the exact thing you came to protect.
Where it stops is worth knowing before you need it. It cannot help a scan. Where a character's exact width cannot be measured it estimates generously, so it will occasionally take a neighbouring word it did not have to — that direction is deliberate, because the other failure is the one that leaks. And it does not excuse you from the check. That is true of every redaction tool, including the paid ones.
The code is published, so you can read it rather than believe us
The module behind the tool is at github.com/pkaur1130/pdf-redact, under AGPL-3.0. It is generated from the file that runs on this site rather than written for the occasion, so the public repo cannot quietly drift from the shipped version. It installs with two dependencies, and npm test runs eleven tests.
The one worth reading is the adversarial one: it redacts a document, reads the text back out of the file, and fails if the secret is still findable. A tool that draws a rectangle passes a visual inspection and fails that test. It is a reasonable thing to ask any redaction tool for, and a reasonable thing to run yourself before you believe one.