How to Properly Redact a PDF (2026)
Redaction failures are famous. The 2010 Manafort filing exposed sanctioned names because the redactors placed black rectangles over text without removing the underlying characters. Court documents across dozens of cases have leaked "redacted" testimony that could be recovered by a simple copy-paste from behind the boxes. The problem isn't laziness — it's that visually hiding text and actually removing it are two completely different operations, and most tools let you do the wrong one easily. This guide covers what real redaction does, why the black-rectangle method keeps failing, and how to redact a PDF without making headlines for the wrong reason.
- Real PDF redaction removes the underlying text, not just covers it.
- Why Redaction Goes Wrong.
- What Real Redaction Does.
- Covers method 1: udt pdf redactor (free, browser-based).
- Covers method 2: adobe acrobat pro.
Why Redaction Goes Wrong
A PDF is structured as layers of content. When you draw a black rectangle over a word in most PDF editors, you're adding a new shape to the page — you haven't touched the word itself. Visually the word disappears. Underneath, the text is still sitting in the PDF's content stream exactly where it was before. Press Ctrl+A, Ctrl+C, paste into a text editor, and every redacted word shows up in the paste. This isn't an obscure technical flaw; it's how PDFs are designed to work.
The same problem appears in other guises. Changing text color to match the background (white-on-white) hides it visually but leaves it fully searchable. Blurring an image using a CSS or filter effect preserves the underlying pixels — the original can often be recovered by reversing the filter. Cropping a page in some editors hides the cropped region without actually deleting it, meaning the hidden text can be restored with a simple uncrop.
These failures keep happening because the tools let you do the wrong thing easily. Most PDF editors have a "draw rectangle" tool, a "highlight" tool, and a "black out" tool that all look like redaction but aren't. The correct tool is specifically labeled as a redaction tool and does something fundamentally different: it deletes the underlying content, not just covers it.
What Real Redaction Does
A proper redaction operation is destructive. The tool identifies the exact text, image regions, or form fields you've marked and removes them from the PDF's content stream entirely, replacing them with solid-color fill blocks. After redaction, the original content is no longer in the file — nothing for copy-paste to recover, nothing for Ctrl+F to find, nothing for accessibility tools to read aloud.
-webkit-backdrop-filter alongside backdrop-filter for Safari support. Without the prefix, the effect is invisible to roughly 25% of mobile users.Proper redaction also handles image content. If the sensitive data is part of an image rather than a text layer, the tool needs to actually paint over and re-save the underlying pixels, not just draw a rectangle on top. Poorly implemented redaction tools miss this case, which is why it's worth verifying image-containing documents specifically.
Good redaction deals with structure beyond visible content: annotations (comments, sticky notes, strikethroughs) often contain copies of the surrounding text, and a complete redaction pass removes those alongside the page content. Form fields store values separately from the visible layout; redacting a form field means clearing the underlying value, not just masking the display.
Method 1: UDT PDF Redactor (Free, Browser-Based)
The UDT PDF Redactor performs real redaction in your browser. It parses the PDF's content stream, locates the text objects or image regions you've marked, removes them from the underlying document, and writes a new PDF with solid-color fill blocks in their place. Nothing uploads. Given the sensitivity of documents people typically need to redact — medical records, legal exhibits, financial statements — local processing isn't a nicety, it's the point.
backdrop-filter inside a position: fixed element can cause severe scroll performance issues. Test thoroughly on real iOS devices.The workflow: load the PDF, draw redaction boxes over the content to remove (or use find-and-redact for specific strings like SSNs and phone numbers to catch every occurrence across a long document), apply the redactions — this step actually deletes the content and can't be undone by removing the rectangle — then download the redacted PDF.
The verification step is not optional. Open the downloaded file, press Ctrl+A, and paste into a plain text editor. Nothing that was redacted should appear. Treat this as the redaction equivalent of running tests before deploying code: a 15-second check catches the one case where something didn't get redacted because the document had an unusual structure.
Method 2: Adobe Acrobat Pro
Acrobat Pro has dedicated redaction under Tools → Redact. Adobe's implementation is the industry standard in law firms and government agencies: it handles every edge case (text, images, form fields, annotations, metadata), offers search-and-redact with regex patterns for SSNs and account numbers, and includes a "Sanitize Document" pass that strips metadata as a final step.
The workflow has two distinct steps: Mark for Redaction (which draws boxes showing what will be removed, but doesn't yet remove anything), and Apply Redactions (which actually deletes the content). Many of the worst redaction failures in public documents happened when reviewers marked content, saw black boxes, and shipped the file without completing the second step. Don't skip Apply, and always re-open the saved file to verify.
For professionals redacting dozens of documents per week — paralegals, compliance officers, FOIA response teams — Acrobat Pro's regex search-and-redact is the feature that justifies the subscription. For occasional redaction, a browser-based tool does the same job without the monthly cost.
The Metadata Problem
Even after perfect content redaction, a PDF often contains hidden information that wasn't on the page: author name, company, software used to create it, creation and modification timestamps, previous filenames, and edit history. For sensitive documents, this metadata can reveal exactly what the visible redaction was trying to hide — the author name identifies the leaker, timestamps show the document was modified minutes before filing, the original filename contains a name the redactor wanted hidden.
Some PDFs also contain embedded content: thumbnail previews (which may have been rendered before redaction was applied), XML-based structured data (XFA forms), attached files, JavaScript, and revision histories. A full sanitization removes all of these. Acrobat Pro has a "Sanitize Document" feature for exactly this purpose; in other tools the steps are manual.
The PDF flattener handles most of these in a single pass by rendering every page to a static image, stripping form fields, annotations, and most metadata. It's a heavier operation — the output is non-editable and slightly larger — but for documents destined for public release, it's worth the trade-off. Combine redaction with flattening for the strongest assurance that nothing hidden slipped through.
Pre-Release Redaction Checklist
Before releasing a redacted PDF publicly — filing in court, sharing with a requester, posting on a website — run through this every time. It catches the mistakes that produce headlines.
Content check. Open the file, Ctrl+A, Ctrl+C, paste into a plain text editor. Nothing sensitive should appear. Search (Ctrl+F) for strings you redacted — name fragments, partial account numbers — and confirm none are found. Image check. Zoom redacted regions to 400% and look for partial character shapes or ghost outlines at the edges of blocks. Metadata check. Open File → Properties. Clear author, subject, keywords, custom fields. Remove the original filename.
Annotation check. Click through each page looking for sticky notes, comments, highlights. Delete or verify non-sensitive. Structural check. Has the document been flattened? Form fields cleared? Any attached files? Second reviewer. For high-stakes releases, have someone else run through the checklist independently. A second pair of eyes catches the one thing you missed.