What is true PDF redaction?
Redaction means removing information from a document so that it can't be read or recovered by the people you share it with. On paper, that used to mean a black marker and a photocopier: the copy only contains what the copier saw. In a PDF, true redaction has to do the same thing. The information under the black box must be gone from the file, not just out of sight.
Why drawing a black box is not secure redaction
A PDF page is built from separate objects: lines of text, images, vector shapes, comments and form fields, drawn one on top of another. When you draw a black rectangle in an ordinary editor, you add one more shape on top. The text underneath is still there. Anyone who opens the file can often select it, copy it and paste it elsewhere, find it with search, or pull it out with a text extraction tool. The same applies to images under the box, to comments attached to the page, and to values stored in form fields. This is how many “redacted” court filings and reports have leaked the very details they meant to hide.
How PDFSanitize redaction works
PDFSanitize uses page reconstruction. For every page with at least one box, it renders the page in your browser at high resolution (300 DPI by default), exactly as it looks, including visible comments, highlights and form values. It then paints each box solid black into those pixels. Finally, it replaces the page with a new one that contains only that image. The original page content, its fonts and images, its comments and form fields, and any scripts attached to the page are not carried over. Objects that nothing points to any more are dropped before the file is saved.
Pages without boxes are left exactly as they were: same text, same links, same comments. The page size, crop and orientation of redacted pages stay the same, and links or bookmarks elsewhere in the document that point to a redacted page keep working.
How the result is checked
After rebuilding, PDFSanitize re-opens the new copy and checks it independently. Each redacted page must contain nothing but the rebuilt image. No text may be extractable from it. None of the page's original content may be left anywhere in the file. Every box must be solid black, and everything outside the boxes must match the original. The page count, the other pages, the metadata and the attachments must also be unchanged. The tool also looks for the redacted text elsewhere in the document, such as the metadata, other pages, comments or document scripts. Only when every check passes does the result say “Redaction verified”. Otherwise it says “Redacted with limitations” and explains what couldn't be confirmed.
What happens to searchable text?
In this version, a redacted page becomes an image. That's what makes it safe, and it's also the trade-off: the whole page, including text outside the boxes, is no longer selectable or searchable, screen readers can't read it, and vector graphics become pixels. The file may also get larger. For these reasons, only the pages you mark are rebuilt. If you need the text on a redacted page to stay searchable, keep a copy of the original somewhere safe and share only what the recipient needs.
Does redaction remove metadata, comments or attachments?
Not across the whole document. Redaction does not automatically remove metadata, comments, attachments or document-level JavaScript elsewhere in the PDF. On a redacted page, comments and form fields are removed, because the page is rebuilt. But the document's title and author, XMP metadata, embedded files, scripts, bookmarks and the annotations on other pages stay as they are. If the text you redacted also appears in one of those places, the result tells you where, without showing the text, and links to the right tool: the PDF Metadata Remover, Remove PDF Attachments or Remove JavaScript From PDF. The PDF Privacy Checker gives you an overview of what else the file contains.
Can redacted content be recovered?
The generated PDF is verified to ensure the original content from rebuilt pages is not retained through the supported checks: the page structure, text extraction, the file's objects and the rendered pixels. Within those checks, the covered content isn't in the new file. What PDFSanitize can't control is everything outside it. Your original file still exists wherever you saved it. The same information may be in other documents, emails or earlier versions. Anything visible outside the boxes, such as a name just next to one, remains readable. Check the preview carefully before applying, and share only the redacted copy.
What's the difference between flattening and redaction?
Flatten PDF turns form fields and review markup into ordinary page content. The page looks the same, and the file keeps everything it had, including the text under a highlight. Flattening is useful for finishing a form, but it hides nothing. Redaction removes content: the covered areas are painted over in a rebuilt page, and the original page content is not kept. If you want to remove highlights or comments rather than information, use Remove Annotations From PDF instead.
Private by design
Rendering, rebuilding and verification all run in your browser. The PDF isn't uploaded or stored, no text is sent anywhere, and the page blocks outgoing network connections while the tool runs. Your original file isn't changed: you download a new copy named with “-redacted” at the end.