How to Redact a PDF Properly Without Exposing Hidden Text

Table of Contents

1. Why a black box is not redaction
2. What "redacted" has to mean
3. How PDFs store text, and why that matters
4. The tools: Acrobat Pro, PyMuPDF and the alternatives
5. How to redact in Adobe Acrobat Pro
6. How to redact programmatically with PyMuPDF
7. Scanned documents and OCR text layers
8. Common redaction failures
9. Known incidents where hidden text was recovered
10. How to verify that redaction worked
11. Cleaning up metadata, comments and file history
12. A redaction workflow for regulated teams

Why a black box is not redaction

The most common redaction in the world is also the most dangerous. Someone opens a PDF, draws a filled black rectangle over a name or a figure, and saves the file. The page looks redacted. The file is not.

In a PDF, a rectangle is a drawing instruction placed on top of the page content. The text beneath it is still a text object in the page's content stream, with its own position and font. When the viewer renders the page, the black rectangle is painted over the text, so the reader sees black. But the text is still there, and any tool that extracts text will return it. Copy and paste from the viewer may return it too, because the selection tool works on the text layer, not on the pixels the eye sees. Search will find it. Screen readers will read it aloud. Accessibility tools, indexing services and document-analysis software will index it.

The failure is not a bug in one product. It follows from how PDF represents content. Drawing and text are separate layers, and nothing ties the rectangle to the text beneath it unless a redaction process explicitly removes that text.

A second, subtler failure is the opposite case. A redaction rectangle is applied to a visual layer, but the content it is supposed to hide lives in another layer: an annotation, a form field, an attached file, an optional content group that is switched off, or a bookmark. Each of these can carry the same sensitive text even if the visible page is clean. Redaction must be applied to the file, not to the page's appearance.

What "redacted" has to mean

Before you choose a tool, define the standard. For legal and compliance work, the working definition should be that the redacted content cannot be recovered from the output file by any reasonable means available to the recipient. That is a stronger requirement than hiding it visually, and it covers several layers at once.

The text must be removed from the content stream, not only covered. Any image-based version of the text must be removed or made unreadable at the pixel level. Text from optical character recognition, which is often stored as an invisible layer beneath scanned images, must be removed. Annotations, form field values, attachments, bookmarks, comments and the document's metadata must be checked and cleaned where they contain the protected material. The file's revision history must not preserve the original content, which is a question of how the file was saved. And the result must be verified with independent tools, not just the tool that produced it.

Different regimes set different expectations. A court may require specific redaction standards. A regulator may require a documented method. Healthcare teams working under HIPAA in the United States need to apply the de-identification rules as well as the file-level controls. Government teams may follow internal classification guidance. The technical standard above is a sensible baseline for all of them, and the procedures below are designed to meet it.

How PDFs store text, and why that matters

To redact a PDF correctly, you need a basic model of the file. PDF page content is a stream of operators. Text is drawn with operators that set the font, position and glyph codes, and the glyphs are shown from embedded or referenced fonts. Images are drawn with image operators that refer to an image object containing pixel data. Vector graphics, including rectangles, are drawn with path operators.

When text is shown with an embedded font, the glyphs are identified by codes that map back to Unicode through the font's encoding or a ToUnicode map. That mapping is what makes text searchable and copyable. Even if a font is embedded as a subset, the text can usually be recovered through the mapping.

Scanned pages are different. The page is an image, and the text the user sees is pixels. Many scanning and OCR tools add a text layer that places invisible text on top of the image, using a rendering mode that draws nothing visible. That invisible layer is searchable and selectable, and it is exactly what a redaction must address.

The implication for redaction is straightforward. A proper redaction removes operators or glyphs that show the sensitive text, removes or overwrites the corresponding pixels in images, removes the invisible text layer where it corresponds to the redacted region, and then produces a file in which those objects do not exist. The visible rectangle is a by-product, not the mechanism.

The tools: Acrobat Pro, PyMuPDF and the alternatives

Several tools perform real redaction. The right choice depends on your volume, your skill set and your need for auditability.

Adobe Acrobat Pro has a Redact tool that identifies text and images to remove, applies the redaction, and removes the underlying content when you apply the marks. It also offers a Sanitize Document function that removes hidden information from the file. For occasional redaction by a trained operator, Acrobat is the most accessible option. Its limitation is that the process is manual, which makes consistency harder across large volumes.

PyMuPDF, a Python library built on the MuPDF rendering engine, provides an API for redaction annotations and an apply step that removes the content under them. It is well suited to batch processing and to building auditable pipelines. Its documentation describes the redaction workflow in detail, and the library is widely used in document-processing systems.

qpdf is an excellent tool for inspecting and rewriting PDF structure, and it is useful for verification and for removing unreferenced objects. It does not perform content redaction by itself, so it is best used alongside another tool.

Ghostscript and similar rendering tools can rebuild a PDF from rendered pages, which removes the original structure and text. That approach produces an image-only or text-reconstructed result, so it is suitable only when you can accept the loss of searchable text.

Specialist redaction software exists for legal and government use and typically adds audit logs, bulk operations and reporting. If you handle high volumes, evaluate these products against the standard above, and verify their output with the methods in this article.

Whatever tool you use, the rule is the same: verify the output independently.

How to redact in Adobe Acrobat Pro

The procedure below describes the general process in Acrobat Pro. Menu locations change between versions, so use the search function in the Tools panel if a name differs.

1. Work on a copy. Save the original in a secure location and make a working copy. Never redact the only version.
2. Open the Redact tool. Choose Tools, then Redact, or search for Redact in the Tools panel. Acrobat switches to the redaction workspace.
3. Mark the content. Use the Mark for Redaction options to select text, drag a region, or search for terms. Searching is useful for names, identifiers and phrases that recur, but it can miss variants, so review every page.
4. Add the redaction properties. Choose the overlay text, if any, and the fill colour. Check whether the mark applies to text and to images. Use the options that remove text under the mark, not only those that place a label.
5. Review each mark. Scroll through every page and confirm that each sensitive item is marked, including items in the margins, footnotes, headers, tables and images.
6. Apply the redactions. Choose Apply. Acrobat will ask you to confirm that the content will be removed permanently. Accept, and review the result on each page.
7. Sanitize the document. Use Sanitize Document, found under the Tools panel or the Protect options depending on the version, to remove hidden information such as comments, attachments, metadata and hidden layers. Choose the options that remove the categories relevant to your case.
8. Save as a new file. Use Save As to write a new file. Do not use plain Save for a redacted document, because incremental saves can preserve earlier content.
9. Verify independently. Follow the verification steps below, using tools other than Acrobat.

The main pitfall in this workflow is the review step. Acrobat's search and mark functions are only as good as the query and the operator's attention. Read each page after the redaction is applied, not before.

How to redact programmatically with PyMuPDF

For batch work, PyMuPDF offers a clear pattern. The process is to add redaction annotations to the page at the locations or for the matching text, then apply the redactions, which removes the underlying content. The following example illustrates the pattern. It is a starting point, not a complete production script.

import fitz  # PyMuPDF

doc = fitz.open("contract-original.pdf")

terms = ["Jane Example", "123-45-6789", "Account 00481"]

for page in doc:
    for term in terms:
        for rect in page.search_for(term):
            page.add_redact_annot(rect, fill=(0, 0, 0))
    # Remove the content under the marks and the images they overlap.
    page.apply_redactions(images=fitz.PDF_REDACT_IMAGE_PIXELS)

doc.save("contract-redacted.pdf", garbage=4, deflate=True, clean=True)
doc.close()

Several details in this example matter. The search_for call returns the rectangles where the term appears, and each rectangle becomes a redaction annotation. The apply_redactions call removes the content under each annotation. The images argument controls how images that overlap the redaction are handled; the option shown removes the image pixels within the redaction area, which is what you want for scanned content. The save call with garbage=4 and clean=True asks the library to rewrite the file, removing unreferenced objects, which helps remove earlier content. The example does not handle annotations, form fields or metadata, so you must add those steps.

Search-based redaction misses content that is split across line breaks, hyphenated, written with different spacing, or encoded in a different way. Review the output and extend the term list. For personal data, consider pattern-based matching, such as regular expressions for account numbers, and combine it with human review.

Test the pipeline on documents where you know the answer. Record which terms matched, which did not, and what remained after verification. A redaction program that has never been tested against a known leak is not a control.

Scanned documents and OCR text layers

Scanned documents are where many redactions fail quietly. A scanned page usually consists of an image and an invisible OCR text layer. A black box drawn over the image hides the pixels, but the OCR layer still contains the words. Search will find them, and copy and paste may return them.

The correct approach has two parts. The image pixels under the redacted region must be removed or overwritten, so the image itself no longer shows the content. The OCR text under the same region must be removed from the text layer. Acrobat's redaction, when it recognizes the page as scanned, may handle both. PyMuPDF's PDF_REDACT_IMAGE_PIXELS option handles the image layer, and the text removal applies to the text layer in the same pass, provided the OCR text sits in a position that the redaction rectangle covers.

Check the OCR text carefully. OCR can misplace words, and a word recognized at a slightly different position may fall outside the redaction rectangle. A redaction that covers the visible word may leave the OCR representation intact. Verify each page with a text extraction tool.

If the page is scanned and the redaction is a serious one, consider the most conservative option: rasterize the redacted page, apply the redaction to the resulting image, and rebuild the PDF from images with no text layer. This removes the OCR text completely. It also removes searchability and accessibility, so document the decision and apply it deliberately.

Common redaction failures

The following failures are the ones that appear most often in reviews of released documents. Each is preventable with the workflow in this article.

Failure 1: Black rectangles without content removal. The most common error. The text remains in the content stream and is recoverable through search or copy. The fix is to use a true redaction function, then verify with text extraction.

Failure 2: Text hidden in the margins or outside the page box. Text positioned outside the visible crop box is still in the content stream. It may not show on screen, but it is extractable. The fix is to inspect the full page, and to use a tool that processes the full content, not only the visible region.

Failure 3: Text in annotations, form fields and comments. A redaction applied to the page content does not necessarily remove annotation text, form values or comments. Those objects live in separate dictionaries. The fix is to review and remove annotations, to clear form fields where they contain sensitive values, and to use sanitization to remove comments.

Failure 4: OCR text under scanned images. Covered above. The image is redacted, but the invisible text remains.

Failure 5: Redaction that uses a different glyph or encoding. Search functions match the text as encoded. A name written with special characters, a ligature or a non-standard space may not match the search term. The fix is to search for variants, and to review each page visually and by extraction.

Failure 6: Metadata and document properties. The author, company, title and keywords may contain the protected information, particularly in a file derived from a source document with a descriptive name. The fix is to clean the metadata as described in our guide to removing sensitive metadata from a PDF.

Failure 7: Incremental saves that preserve earlier content. Saving a redacted PDF with a plain save can append changes to the original file rather than rewriting it. The earlier content remains in the byte stream. The fix is to save as a new file, rewrite the document structure, and verify that no earlier content is recoverable.

Failure 8: Attachments and embedded files. A redacted PDF may carry an attachment that contains the unredacted original, a spreadsheet or a source document. The fix is to list and remove attachments before release.

Failure 9: Bookmarks, named destinations and outlines. Bookmark titles can contain sensitive phrases, such as the name of a person or a case, even when the page body is clean. The fix is to review the outline panel.

Failure 10: Assuming the viewer's rendering is the file's truth. A reviewer who looks only at the rendered page will not see these failures. The fix is to verify with extraction tools, and to treat the file as the object of review.

Known incidents where hidden text was recovered

Redaction failures are not hypothetical. Publicly reported incidents over the past two decades have involved government, court and corporate documents in which text covered by a black box or a similar mark could be recovered from the released file. Journalists, researchers and members of the public have repeatedly demonstrated the technique by copying text from the released PDF or by extracting it with a standard tool.

We do not reproduce the details of particular cases in this article, because the accounts vary in their accuracy across reporting, and we have not independently re-verified each one for this guide. The point for your procedures is the pattern. The same failure modes recur across agencies, courts and companies: a visual redaction without content removal, a scanned document with a retained text layer, and an incremental save that preserved an earlier version. Anyone who publishes or releases documents should treat those failures as known and test their own process against them.

If you release documents as part of a legal, regulatory or public-records process, review how your organization has handled previous releases, and check whether the redaction in those releases can be recovered with the verification steps below. A review of past releases is often the most useful audit you can carry out.

How to verify that redaction worked

Verification is independent of the redaction tool. Its purpose is to check what a recipient can recover from the file. Use at least three independent checks.

Check one: Text extraction. Use poppler's pdftotext to extract all text from the output. This reads the content stream without relying on the viewer's rendering:

pdftotext -layout contract-redacted.pdf - | grep -i "Jane Example"

If the search returns nothing for each protected term, the text layer does not contain it. Run the search for variants, including partial names, identifiers in different formats, and any term that matched in the original. Compare the extraction against the original file to confirm that the tool is reading the text at all.

Check two: Raw structure. Use qpdf to produce a readable version of the file, then search the decompressed output:

qpdf --qdf --object-streams=disable contract-redacted.pdf inspect.pdf
grep -a -i "Jane Example" inspect.pdf

Compressed object streams can hide text from a simple search, so the QDF step is important. A hit in the raw structure, outside the visible page, means that the content is still present and must be dealt with.

Check three: Visual and OCR review. Render each page to an image at a reasonable resolution, and review the rendered result. Then run an OCR tool over the rendered image to confirm that the visible text does not contain the protected content. This check catches cases where the pixels were not redacted but the text was, and cases where the image retains recognizable content despite the black box.

Check four: Annotation and attachment inventory. List the annotations, form fields, attachments and bookmarks using a tool that reports them. PyMuPDF can enumerate annotations and embedded files, and Acrobat's panels show comments and attachments. Confirm that no protected material remains in these objects.

Check five: Revision history. Confirm that the file was saved as a full rewrite. Use qpdf --check to see whether the file contains more than one cross-reference section. More than one section means that earlier content may still be in the file.

Record the results of each check, the tool versions and the date. Keep the record with the release. If a check fails, do not release the document. Return to the source, redo the redaction, and repeat the verification.

Cleaning up metadata, comments and file history

Redaction removes the content you marked. It does not necessarily remove the surrounding information that identifies the document, its author or its history. For the document to be releasable, clean the surrounding material as well.

Remove comments and reviewer notes that contain the protected information, or that reveal the internal discussion about the redaction. Remove the author, company and title fields where they contain protected information, and clear the XMP metadata stream. Our guide on removing sensitive metadata from a PDF covers those steps in detail.

Remove attachments unless they are part of the public release, and check that each one is itself redacted. Review the bookmarks and the form fields. Remove any form values that contain protected material.

Finally, rewrite the file to remove earlier revisions, and verify again. A redaction that leaves an earlier version in the file is incomplete, however carefully the visible page was handled.

A redaction workflow for regulated teams

For legal, compliance, government and healthcare teams, a repeatable workflow reduces the risk of a failure and creates the record you may need later. The following sequence is a sound baseline.

1. Define the redaction standard for the document class, including the categories of information to be removed and the recipients.
2. Work on a copy, and keep the original in controlled storage.
3. Identify the content to be redacted, using both search and manual review, and record the list.
4. Apply the redaction with a true redaction tool, such as Acrobat Pro's Redact function or PyMuPDF's apply step.
5. Clean the document's metadata, comments, attachments, form fields and bookmarks.
6. Save as a new file and rewrite the structure.
7. Verify with text extraction, raw structure inspection, rendered-page review, annotation inventory and revision checks.
8. Have a second person review the output against the redaction list.
9. Record the steps, the tools, the verification results and the reviewer's sign-off.
10. Release the document through a controlled channel, and keep the record with the release.

Consider whether the document should be released at all. In some cases the correct output is a summary, an extract or a new document that contains only the information that may be shared. Redaction is a tool for releasing parts of a record, not a substitute for deciding what should leave the organization.

For documents that will be encrypted after redaction, complete the redaction first. Encryption protects the file from people without the password, but it does not remove the content that a recipient with the password will see. Our article on how to encrypt a PDF file explains what encryption protects and what it does not.

For documents that are shared with a limited audience rather than released publicly, you may also use controls such as a secure sharing link or a zero-knowledge encrypted storage model, which reduce the exposure of the document while it is being shared. Redaction and sharing controls solve different problems, and mature workflows often use both.