Privacy · 8 min read
How to Redact a PDF Properly: Why a Black Box Is Often Not Enough
A bank statement for a landlord, a payslip for a loan application, a contract shared with a colleague as an example: again and again, a few details in a PDF need to disappear before the file leaves your hands. The obvious fix is a black rectangle over the name or the IBAN. On screen it looks final. Technically, it often is not.
This guide explains why covered text frequently remains in the file, which other places in a PDF can hold personal data, and how to work cleanly with Toolula's Redact PDF and Smart Redaction tools. Both run in your browser, so the document is never uploaded.
Why the black box is deceptive
A PDF is built from layers of drawing instructions: this text in that font here, an image there, a comment on top. When you draw a rectangle over an IBAN in an ordinary PDF editor, you simply add another instruction, a black rectangle. The text underneath stays in the document unchanged. Anyone who selects and copies it, uses the search function or opens the file with a text extraction tool will find it again.
The same applies to rectangles added as comments or form fields, to text coloured black on black, and to images that were merely resized or covered. Even people who black out a page in an image editor and paste it back can be caught out by earlier versions: PDFs can append changes when saved instead of rewriting the file, and older revisions then remain technically present.
The result is a document that looks redacted to everyone who reads it normally and is not redacted for anyone who looks a little closer. That is the worst outcome, because the sender believes the data is gone.
Where else personal data hides
Even when the visible text is removed cleanly, a PDF can reveal what you meant to hide in other places. Document properties often list author, software and title, sometimes with a name or case number. Bookmarks and tables of contents copy headings word for word. Form fields store their values separately from what is drawn on the page, and accessibility tags can carry a copy of the text for screen readers.
Then there are attachments, comments, links whose addresses give something away and, in scans, the invisible OCR text layer. A thorough redaction deals with these places as well, or removes them altogether.
- The text layer under the box
- Earlier revisions from incremental saving
- Metadata, bookmarks, form values and tags
- Attachments, comments and links
Two safe methods: flatten the page or cut the text out
The simplest safe method is to turn the affected page into an image with the boxes burned in. That is how Redact PDF works: you drag rectangles over the private passages on the page previews, check each page and click Redact & download. Every page with at least one box is redrawn at 150 DPI, and the black areas become part of the image. Pages without a box stay as they are. The drawback is that the rest of the text on a flattened page can no longer be selected or searched either.
Smart Redaction is more precise. It deletes the characters under each box from the text layer, overwrites image pixels beneath it and cleans up old revisions and orphaned objects, while the remaining text stays selectable. If part of a page cannot be cut out safely, the tool flattens just that page to an image and tells you so. After export it reads the file again and confirms Verified: no text is readable under any box.
Find automatically, decide by hand
On long bank statements, marking everything by hand is tedious and error-prone. Smart Redaction therefore scans the PDF as soon as you open it for IBANs, BIC/SWIFT codes, German tax numbers and tax IDs, EU VAT IDs, email addresses, phone and card numbers, and optionally amounts and dates. IBANs are validated by country length and checksum, card numbers by the Luhn algorithm and the German tax ID by its check digit, so not every column of digits shows up as a hit.
Under Your terms you add words or regular expressions, such as a doctor's name or a customer number. Choosing Whole line instead of Just the match blacks out the entire transaction row, which is handy for private items on a statement. Every find can be included or skipped on the page, and signatures or photos can be covered by dragging a box. Box style offers Black, White or Label, and Also remove metadata & hidden data deletes author, software, XMP, JavaScript and attachments as well.
Scanned pages without a text layer cannot be read by the detectors. The tool points this out; redact those pages by hand, or make the scan searchable with OCR PDF first.
A checklist before you send
Redaction serves data minimisation: pass on only what the recipient needs for their purpose. If in doubt, ask beforehand which details an authority, bank or landlord actually needs to see, so the document does not become useless to them.
Check the result before sending it. Try to select text under a box, and search for a redacted word with the search function. Look at the document properties. Remember that any redaction invalidates a digital signature, so keep the signed original and send the redacted copy. And make sure you never attach the original by mistake.
Frequently asked questions
Is it enough to highlight text in black in Word and save as PDF?
No. A black highlight or rectangle only covers the text; when exported, it still ends up as text in the PDF and can be copied. Delete the text in the source document, or use a tool that removes it from the PDF.
What is the difference between Redact PDF and Smart Redaction?
Redact PDF turns every page with a box into an image with the boxes burned in, which is simple and safe, but the text on those pages can no longer be selected. Smart Redaction finds personal data automatically, cuts out only the characters under the boxes and verifies the result.
Does this work on scanned documents?
Automatic detection needs a text layer. For scans, draw boxes by hand or make the document searchable with OCR PDF first. Image pixels under a box are overwritten in both tools.
Does a digital signature survive redaction?
No. Redaction changes the document, so any existing signature will show as invalid. Redact a copy and keep the signed original.
Is my document uploaded?
No. Detection, redaction and verification run in your browser on your own device. For bank statements and payslips in particular, this avoids creating another transfer of personal data.