How to Redact a PDF Securely (So It Can’t Be Unredacted)

Last updated: July 31, 2026

To redact a PDF securely, you must remove the text from the file’s content streams, not draw a black box over it. Then clear metadata and form fields, save the result as a new file, and verify it: copy-paste the page text into a text editor and search the PDF for the redacted content. If anything you redacted appears, the redaction failed.

You need to share a document, but you don’t want to share everything in it. Maybe it’s a contract full of client names, a medical record that needs to go to an insurer, or a legal filing that contains witness addresses. The document has to go out, but certain information has to stay hidden.

PDF redaction is the permanent removal of text and data from a PDF file so that no one who receives the document can recover it. But redaction is easier to get wrong than most people realize. This guide covers how PDF redaction actually works, why it fails, and how to do it properly.

PDF redaction fails in two ways

Either the redaction only hid the data instead of removing it, or the process missed personal information in places like headers, form fields, and metadata.

Failure 1: the text is hidden, not removed

The most common redaction failure is simple: someone draws a black rectangle over the text, but the text itself is still in the file. The rectangle is just a visual layer sitting on top. Anyone who selects the text and pastes it into another document can read everything underneath. This isn’t a theoretical risk. It has happened at the highest levels, twice.

In both cases, the problem was the same: the appearance of the text was hidden, but the data itself was untouched.

Failure 2: some personal information was missed

The second failure mode is subtler. The redaction process works correctly and genuinely removes data, but it doesn’t catch everything. A name appears in the header and the body, but only the body instance gets redacted. An email address is embedded in a form field that nobody thought to check. The document’s metadata still contains the author’s full name.

PDFs can contain personal data in places that aren’t obvious on the page, such as form field values or document metadata. A redaction process that only looks at the visible text on each page will miss these hidden sources. And if you’re manually scanning a 50-page document for every mention of a person’s name, you’re likely to miss at least one.

This is why automated detection matters. A human reviewer should always be part of the process, but tools that can scan the full document, including metadata and form fields, are much less likely to miss something buried on page 37.

Masking vs. redaction vs. sanitizing

You’ll hear these three terms used in discussions about removing sensitive information from documents. They mean different things, and confusing them can lead to exactly the kind of failure described above.

In practice, a properly redacted document has been both redacted and sanitized: the visible PII has been removed from the content, and the hidden PII has been stripped from the metadata and other non-visible structures.

Masking hides data. Redaction and sanitization remove it.

How PDF redaction actually works (and why it’s hard)

If you’ve ever tried to edit a PDF and found it frustrating, there’s a good reason. PDFs were designed to be a reliable display format, a way to make sure a document looks exactly the same on every screen and every printer. They were not designed to be easy to edit.

When you save a document as a PDF, the text isn’t stored the way it is in a Word document or a plain text file. Instead, the PDF uses a low-level page description language that places individual characters or groups of characters at precise coordinates on the page. A single sentence might be stored as dozens of separate text-drawing instructions, each specifying a font, a position, and a string of characters. Some PDF generators (like Google Docs) emit a separate drawing instruction for every single character.

This matters for redaction because you can’t just “find and delete” a name from a PDF the way you would from a text file. You have to parse the PDF’s internal content streams, figure out which drawing instructions produce the text you want to remove, and then modify or remove those instructions without breaking the rest of the page layout. If a name spans two drawing instructions, you have to handle both. If it’s in the middle of a longer text run, you have to split that run and keep the surrounding text intact.

On top of this, PDFs can use different font encoding schemes. A straightforward PDF might use standard Latin character encoding, but many modern PDF generators use more complex encodings where the characters in the file don’t directly correspond to the letters you see on screen. To read (and therefore redact) the text in these PDFs, you need to decode each font’s character mapping individually.

Proper redaction requires parsing and rewriting the PDF’s content streams, which is why so many tools fall back to drawing black boxes that don’t work.

How to properly redact a PDF, step by step

Proper redaction has four steps: identify all the personal information, remove the data (don’t cover it), strip metadata and hidden data, and save the result as a new copy. If any step is skipped, the redaction may be incomplete or reversible. The steps below apply whether you’re using a dedicated redaction tool or a PDF editor.

1. Identify all content that needs to be removed. Scan the full document for personal information, not just the sections you already know about. Check every page, including headers and footers. Check form fields, which can contain data that isn’t visible in the normal page view. Check the document’s metadata properties: author, title, subject, keywords. If you’re using an automated detection tool, review its findings and look for anything it may have missed.
2. Remove the data, don’t cover it. The text must be deleted from the PDF’s content streams, not just obscured with a visual overlay. In Adobe Acrobat Pro, this means using the dedicated Redact tool (under Tools → Redact), not the highlighter or the rectangle drawing tool. If you’re using another tool, make sure it modifies the actual content of the PDF rather than adding an annotation layer on top. After applying redactions, the original text should be gone from the file entirely.
3. Strip metadata and hidden data. After redacting the visible content, clean the document’s hidden data. Remove or clear metadata fields that contain personal data (author name, for example). Flatten or remove form fields. Strip any embedded comments or revision history. Adobe Acrobat calls this “sanitizing” the document, and it’s available under the Redact tool’s options. If your tool doesn’t handle this automatically, do it as a separate step.
4. Save as a final, non-reversible copy. Save the redacted document as a new file. Do not save over the original, as you may need it later for your own records. The redacted copy is the one that gets shared. Some tools offer a “save and flatten” option that merges all layers and removes any possibility of undoing the redactions.

How to verify your redaction actually worked

Verification is the step most people skip, and it’s the most important one. After redacting a document, you should verify that the redaction is complete before sharing the file. Here are three concrete tests you can run.

The copy-paste test. Open the redacted PDF. Select all the text on a page (Ctrl+A or Cmd+A), copy it, and paste it into a plain text editor like Notepad or TextEdit. If any of the redacted text appears in the pasted output, the redaction failed. The text is still in the file, hidden behind a visual overlay.

The search test. Use Ctrl+F (or Cmd+F) to search for a word or phrase that you redacted. If the PDF viewer jumps to a black rectangle, the text is still present in the file’s content and the “redaction” is just a visual mask. A properly redacted document will return no search results for removed content.

The metadata audit. Open the document’s properties (usually under File → Properties or Document Properties). Check the author, title, subject, and keywords fields. If any of these contain personal information that should have been removed, the sanitization step was missed. Some PDF tools also have a “hidden data” scan that checks for embedded comments, form field data, and other non-visible content.

If your redacted document passes all three tests, you can be reasonably confident that the redaction is complete. If it fails any of them, go back and redo the redaction using a tool that actually removes the underlying data.

If you can select, copy, and paste the “redacted” text, the redaction failed.

Why you shouldn’t upload sensitive documents to redact them

The whole point of redacting a document is to protect personal data. But most redaction tools that offer automatic PII detection require you to upload your document to a server for processing. You’re sending your most confidential files, the ones that contain the personal information you’re trying to protect, across the internet to someone else’s infrastructure.

For many use cases, this creates a real compliance problem. If you’re redacting medical records to comply with HIPAA, uploading those records to a third-party server may itself be a HIPAA violation. If you’re handling client files under attorney-client privilege, sending them to an external service may waive that privilege. Even if the service’s privacy policy says they don’t store your data, the network transfer itself is a point of exposure.

This is why client-side processing matters. Tools like docscrubber run entirely in your browser, so the PDF never leaves your device. The machine learning model that detects personal data is downloaded once and runs locally. Your document, the extracted text, and the detection results never touch a server. You can verify this yourself by opening your browser’s Network tab and watching what happens when you process a document: no document data is transmitted. For the full details, see how we handle data.

The safest redaction workflow is one where the document never leaves your device.

Redaction requirements by industry

Legal filings

Lawyers have a professional duty to redact personal data from court filings. The American Bar Association’s Model Rules of Professional Conduct establish competence and confidentiality obligations that extend to document handling. Many federal and state courts have specific rules about what must be redacted from public filings, typically Social Security numbers, dates of birth, financial account numbers, and the names of minor children. The Federal Rules of Civil Procedure (Rule 5.2) require these redactions for all electronically filed documents. Getting this wrong doesn’t just expose your client’s data. It can result in sanctions, malpractice claims, or disciplinary action.

Healthcare (HIPAA)

The Health Insurance Portability and Accountability Act (HIPAA) requires that protected health information (PHI) be removed from documents before they can be shared outside of permitted uses. PHI includes not just medical information but also names, addresses, dates, phone numbers, email addresses, Social Security numbers, and any other information that could identify a patient. HIPAA’s Safe Harbor de-identification method specifies 18 categories of identifiers that must be removed. Incomplete redaction of PHI can result in fines ranging from $100 to $50,000 per violation, with an annual maximum of $1.5 million per violation category.

Government and FOIA

Government agencies that respond to Freedom of Information Act (FOIA) requests must redact information that falls under one of FOIA’s nine exemptions, including personal privacy information, classified material, and law enforcement records. The challenge here is volume: FOIA responses often involve hundreds or thousands of pages, and every page must be reviewed. The Epstein files incident described above is a reminder that even the Department of Justice is not immune to redaction failures.

Frequently asked questions