Redaction is the one PDF job where getting it wrong doesn't just look sloppy — it leaks. The document goes out, everyone assumes the sensitive parts are gone, and later somebody drags a selection across a black rectangle, hits copy, and pastes the "removed" text into a note. It has happened to law firms, government agencies, and large companies, more than once, for the same reason every time: someone covered the text instead of removing it.
The cases where redaction comes up are rarely casual — legal filings before they're public, medical records shared with an insurer, financial reports going to a narrower audience than the appendix, internal memos released under a records request. In all of them the stakes are other people's information, which is why this guide is about the difference between covering and removing — and how to do the second one with Redact PDF, which destroys sensitive text rather than drawing over it, entirely in your browser so the file never leaves your machine.
Why a black box over text isn't redaction
A PDF page is a stack of objects. When you draw a black rectangle across a paragraph in a typical editor, you add one more object on top — and the text underneath is untouched. It's still in the file, still selectable, still copyable, and still extractable by any free text-extraction tool in seconds. The rectangle is a costume, not a deletion.
The consequences are public and repeating. Court filings, government reports, and corporate documents have all been published with "redacted" sections that turned out to be fully recoverable. What makes the mistake so durable is that it looks convincing — on screen and on paper — and looking convincing is exactly what people check. Nobody verifies that the content is gone; everybody verifies that it looks gone.
What real redaction actually does
Real redaction removes the content from the file. There is no layer to lift and no hidden string to extract, because the characters no longer exist anywhere in the document.
That is how the tool works: pages where redactions were applied are rasterized into images with the sensitive text physically destroyed — it can't be recovered by selecting, copying, or inspecting the PDF. Pages without redactions keep their original text layer, fully selectable and searchable, so the rest of the document behaves normally. Only the redacted pages become image-based.
How to redact a PDF
- Open Redact PDF and drag in your file — up to 100 MB.
- Enter your search terms, comma-separated — a person's name, a phone number, an email address.
- Run the redaction: every occurrence of each term, on every page, is found and blacked out.
- Download the result and verify it before the file goes anywhere.
The whole process runs locally in your browser. That matters more here than almost anywhere else: the document you're redacting is sensitive — that's why you're redacting it — and browser-based processing means it's never uploaded to a server, never stored, never retained. The only copy of the unredacted file that ever existed is the one on your machine.
How to check your redaction worked
Treat verification as part of the job, not an optional last step. Open the downloaded file and go to the redacted pages: your terms should appear as blacked-out regions, and because those pages are now images, there should be nothing to select. Try dragging a selection across a redacted area — nothing copies, because nothing is there.
Then search the document for each term. Pages that weren't touched keep their text layer, so search still works across them — and it should come up empty for everything you redacted. If a term still appears somewhere you expected to be clean, redo the pass before sharing the file, not after.
Choosing what to redact
The tool finds occurrences of the exact terms you give it, which puts the real work in building the list. Names come in variants — full name, first name plus initial, initial plus surname — and each variant needs its own term. An email address can appear with or without a display name around it. Account numbers and phone numbers get formatted differently in different places, and each formatting is a different string.
Read the document once and write down every piece of text that shouldn't survive. Then read it again after redacting. And know the boundary of the method: search-based redaction matches text, so it can't catch sensitive information that exists only inside an image — a photograph of a document, a chart with the numbers baked in. Those need a manual pass with your own eyes before the file ships.
The one case redaction can't handle: scanned PDFs
Redaction searches for real text in the PDF. A scanned PDF contains images, not text, so there's nothing for the search to find. The fix is order of operations: run OCR first to add a text layer to the scanned pages — OCR PDF does exactly that — and then redact against that new layer. OCR first, redaction second, every time.
What redaction doesn't cover
Removing text from pages isn't the end of document hygiene. Two more things deserve a pass before a sanitized file goes out the door.
First, metadata. A PDF carries information that never appears on any page — the author name recorded by the software that made it, the tools used, timestamps. If you're cleaning a document for release, review what it says about itself; PDFlyHQ has a dedicated PDF Metadata Editor for that job. Second, distribution. Redaction decides what's in the file; a password decides who can open it. If the redacted document still shouldn't be public, protect it before sending it on — the full walkthrough is in How to Password-Protect a PDF.
Done right, the whole sequence is short: OCR if it's a scan, list the terms, redact, verify, clean the metadata, lock it if needed. And none of it — including the step where the sensitive file exists in unredacted form — ever leaves your machine.