Privacy · 6 min read
Sharing a Confidential PDF: Redact, Strip Metadata, Archive as PDF/A, Sign Last
A statement for the bank, a contract for a client, a document for an authority: before a sensitive PDF leaves your hands, you often want to remove some data, make sure nothing hidden travels along, store it in an archive format and prove that it hasn't been changed. Each of these steps is simple on its own. Done in the wrong order, they undo each other.
This guide gives the order that works and explains why. Every tool mentioned runs in your browser, so the document is never uploaded at any step.
Why the order matters
Every one of these steps rewrites the PDF. A digital signature, however, seals exactly the bytes that existed when it was made: any later rewrite makes it show as broken or as followed by changes. PDF/A, for its part, forbids encryption, scripts and attachments. Hence the rule: everything that changes content comes first, the archive format comes next, and the signature comes last.
- 1. Redact what the recipient does not need
- 2. Remove metadata and hidden data
- 3. Convert to PDF/A if the file has to last
- 4. Sign digitally, as the very last change
- 5. Verify the signature before sending
Step 1: Redact for real
A black rectangle drawn over text usually leaves the text underneath copyable. Smart Redaction scans the PDF for IBANs, tax numbers, VAT IDs, email addresses and phone numbers, lets you review every find and cuts the characters out of the file itself, overwriting image pixels beneath each box. After export it re-reads the result to confirm nothing is readable under any box.
Scanned pages have no text layer for the detectors to read. Make them searchable with OCR first, or draw the boxes by hand.
Step 2: Remove what is hidden
Author names, the software used, creation dates, XMP data, attachments and scripts all travel with a PDF. Smart Redaction removes them when "Also remove metadata & hidden data" is on. For a file you don't need to redact, Remove Metadata does the same job on its own.
Step 3: PDF/A when the file has to last
Archives, tax records and many authorities prefer PDF/A, which embeds fonts and a colour profile so the document looks the same in decades. PDF to PDF/A keeps the text selectable when every font is embedded and otherwise offers to convert the pages to images. Because PDF/A forbids encryption, don't password-protect a file you need as PDF/A; send it through a secure channel instead.
Step 4: Sign last, then check
Now apply the digital signature with your .p12 or .pfx certificate, ideally with a trusted timestamp. Toolula appends it as an incremental update, so earlier signatures stay valid. Then open the signed file in Verify PDF Signature: it should show Intact and Covers the whole document. If it says "File changed after this signature", something was modified after signing and the order needs another look.
Frequently asked questions
Why not sign first and redact afterwards?
Redaction rewrites the content the signature covers, so the signature would show as broken. Redact a copy, then sign the redacted version.
Can I also password-protect the PDF?
Encryption rewrites the whole file and PDF/A does not allow it, so it cannot follow PDF/A or a signature. If you need a password, protect a separate copy, and keep in mind that other tools can't open it until it is unlocked.
Does the signature still verify when the recipient opens the file?
Yes, as long as nobody changes the file. The recipient's PDF reader shows the integrity check; whether it also shows a green check depends on whether your certificate is on the Adobe or EU trust lists.
Is the document uploaded at any step?
No. Redaction, metadata removal, PDF/A conversion, signing and verification all run in your browser on your own device. Only with a trusted timestamp is a 32-byte fingerprint of the signature sent to a time-stamp authority, never the document.