How to Redact a PDF Properly: Why a Black Box Isn't Enough, and How to Do It for Real

You need to send a bank statement as proof of income without exposing every transaction. Or publish a contract as a template without the parties' names and ID numbers. Or send a medical report to an employer without the diagnosis. The obvious fix: draw a black box over it and save.

The problem is that this removes nothing. The black box is a layer on top of the text, and the original text is still in the file underneath. Anyone can select the area and copy it, or open the file in another program, and read everything you "hid". Government agencies, law firms and large companies have all made this mistake, and information that was supposed to be blacked out has been made public as a result.

This guide explains the difference between covering and real redaction, gives you a free foolproof method, shows how to verify it, and lists the hidden data everyone forgets.

Why a black box isn't enough

A PDF is layers of drawing commands: "draw this text here," then "draw a black rectangle here." Adding a rectangle adds a new command; the original text command stays. The screen shows the rectangle on top, but:

• Selecting and copying picks up the text underneath.
• Search (Ctrl+F) finds the covered word.
• Text extraction tools read it directly.
• Some readers let you delete the rectangle itself (as an annotation or shape), revealing the text.
• Screen readers read the covered text aloud.

The same applies to black highlighting, white text, a black image placed on top, or shrinking the font to nothing.

The free foolproof method: turn the page into an image

The idea: once the page is an image, there's no text underneath at all — the cover and the content become pixels in a single picture.

Steps:

1. Identify the pages with sensitive information. If it's one or two pages of a long file, extract them with Split PDF.
2. Convert those pages to images with PDF to JPG at 200 or 300 DPI so they stay legible.
3. Cover the information in the image with any image editor — your phone's photo editor (draw or markup with a solid shape), Paint on Windows, or Preview on Mac. Use a 100% opaque rectangle, not a translucent highlighter or light blur.
4. Convert the images back to PDF with JPG to PDF.
5. Reassemble if the file is long: merge the processed pages with the rest using Merge PDF and order them with Organize PDF.
6. Verify as described below.

All of these tools run in your browser, so the sensitive document is never uploaded during the process — which matters here more than anywhere.

Downsides: - Converted pages become images: you can't search or copy their remaining text. If you need that, run OCR on the final file. - Size may grow; compress with Compress PDF if needed.

Professional redaction (paid software)

Tools like Adobe Acrobat Pro include a genuine Redact feature:

1. Select text or an area, or search for patterns such as phone numbers or emails.
2. Mark it for redaction.
3. Click Apply — the content is deleted from the file and replaced with a box.
4. "Remove hidden information" cleans metadata, layers and attachments.

The advantage is that the remaining text stays searchable. But remember: marking without applying removes nothing — another common mistake.

How to verify redaction worked

Don't trust appearances. Test the final file:

1. Select and copy: select the covered area and its surroundings, copy, paste into a text editor. The removed text must not appear.
2. Search: press Ctrl+F and search for a word or number you removed. It must not be found.
3. Extract all text: use PDF to text and search the output.
4. Open it in another program: a different browser or reader.
5. Check other pages: does the information repeat in a header, footer, summary table or appendix?

If the file passes all of these, the redaction is sound.

Hidden data everyone forgets

Redaction isn't only about what's visible on the page:

What to redact: a checklist

Depending on purpose, consider redacting:

• ID, passport and social security numbers.
• Bank account and card numbers — showing only the last 4 digits is often enough.
• Addresses, phone numbers and personal emails.
• Dates of birth.
• Medical information not required.
• Signatures if the document will be published.
• Names of uninvolved third parties.
• Unrelated financial transactions.

And the most important rule: send the minimum that achieves the purpose. Sometimes the simplest answer isn't redaction but extracting only the required page with Split PDF.

Redacting on your phone in 5 minutes

1. Open PDF to JPG in your browser, choose 200 DPI and convert.
2. Save the images: on iPhone, open the ZIP in Files → Share → Save Image; on Android, extract the ZIP.
3. Open each image in your photo editor → Markup/Draw → choose a filled rectangle in black and cover the details with a margin.
4. Save. Make sure the editor exports a flattened image — some editors keep edits as an undoable layer on the original, but exporting or sharing bakes them into the final image.
5. Open JPG to PDF, choose the images in order and convert.
6. Test: open the PDF and try to select text. Nothing should select.

Practical scenarios

Bank statement as proof of income

Extract the pages showing your salary. Convert to images and cover other transactions and all but the last 4 digits of the account number. Convert back, test copying, then send.

Publishing a contract as a template

Convert pages to images and cover names, numbers, addresses, signatures and amounts. Or better: retype the contract in Word with placeholder names — cleaner and more readable.

Screenshot of a chat or email

Cover names, phone numbers and profile photos with solid rectangles before converting to PDF. Watch for names in title bars and notifications.

Medical report for an employer

Ask first what's actually required — a short doctor's note is often enough. If the report must be sent, cover diagnoses that aren't relevant.

Common redaction mistakes

1. A black box without converting or applying redaction. By far the most common.
2. Changing text colour to white. The text is still there and copies.
3. Redacting one page but missing the same info elsewhere — another page or an appendix.
4. Forgetting metadata and the file name.
5. Light blur instead of a solid cover.
6. Uploading the sensitive original to an unknown website to redact it — handing the full original to a third party.
7. Not keeping the original safe — or, worse, sending the original by mistake. Name the processed version clearly, e.g. Statement-REDACTED.pdf.

Redaction, law and privacy

In many jurisdictions, data protection laws (such as the GDPR in Europe) require sharing only the personal data necessary for a purpose. Proper redaction isn't just caution; it can be a legal obligation when sharing documents containing other people's data — employees, customers, patients.

At the same time, don't remove information that's officially required in a document you submit to an authority, and don't alter an official document issued by someone else and present it as the original. Redaction protects privacy when sharing; it doesn't change the substance of official documents.

FAQ

Does a black box in a PDF delete the text?

No. It covers it visually only; the text underneath can be copied or searched.

What's the easiest free way to redact properly?

Convert the page to an image, cover the information with a solid rectangle in an image editor, convert back to PDF, and test copying and searching.

Can text be recovered after converting the page to an image?

There's no text under the cover after conversion. Light blur can sometimes be reversed, so always use a solid cover.

Does WPPR have a one-click redaction tool?

Not a one-click tool. But PDF to JPG, JPG to PDF and Edit PDF metadata together form the foolproof method — all inside your browser.

How do I know if a PDF I received was redacted properly?

Try searching and copying in the covered areas. If text appears, tell the sender immediately and don't redistribute the file.

Should signatures be redacted?

If the document will be published, usually yes — signature images can be misused.

Bottom line

Real redaction means the information no longer exists in the file — not just that it's covered on screen. The free foolproof method: convert sensitive pages to images, cover with a solid rectangle, convert back to PDF, clean the properties and file name, then test copying and searching before you send.

Start with PDF to JPG, then JPG to PDF — free, and your sensitive document never leaves your device.

Sources

• Sanitization (classified information) (Wikipedia)
• Metadata (Wikipedia)
• Exif (Wikipedia)
• General Data Protection Regulation (Wikipedia)