How to redact a PDF properly, so the hidden text is really gone

You need to share a bank statement but not your account balance, send a salary slip without your PAN, or post a court document with someone’s phone number hidden. The obvious approach is to draw a black box over the sensitive part. On screen it looks perfect. Unfortunately, in many cases the information is still sitting in the file, and anyone who knows where to look can get it back in seconds.

Why a black box is not redaction

A PDF page is built in layers. The text you see is stored as actual characters, and pictures are stored as images. When you draw a rectangle, add a black highlight, or place a black-filled shape using a normal PDF editor or annotation tool, you add a new layer on top. Everything underneath is untouched. That leaves several easy ways to recover it:

• Copy and paste. Select the area and copy it, or select all text on the page, and paste into a notes app. The “hidden” text appears.
• Search. Searching the PDF for a name or number still finds it, and often highlights it right under the box.
• Move or delete the box. If the box is an annotation, anyone can click it and press Delete.
• Text extraction. Converting the PDF to text or Word pulls out every character, ignoring what is drawn on top.

The same problem applies to other tricks: changing text colour to white, placing a white text box over a number, or cropping a page so part of it is out of view. Cropping only changes the visible area; the content outside it remains in the file. Scans are not safe either: a box on top of a scanned image leaves the full image underneath.

What real redaction does

A proper redaction tool removes the content itself, then marks the place where it was. For each area you mark:

• Text characters inside the area are deleted from the page, not covered.
• The part of any picture inside the area is replaced with solid colour, so the original pixels are gone.
• Lines and shapes inside the area are removed.
• A solid box is drawn in their place so readers can see something was redacted.

Pyrbit’s Redact PDF works this way: its engine deletes the text, pictures and drawings under each box and then checks nothing is left. The file is processed in your browser, which matters here, since the whole reason you are redacting is that the document is sensitive.

Step by step: redacting a PDF

1. Work on a copy. Redaction is permanent by design. Keep the original somewhere safe and redact a copy.
2. Open the PDF in the redaction tool and read through every page once before marking anything, so you know where sensitive details appear.
3. Mark areas by hand. Drag a box over each item to remove: names, numbers, signatures, photographs, addresses. Make the box slightly larger than the text so no edge of a letter survives.
4. Use search to find repeated details (see the next section). A phone number in the header of every page is easy to miss by eye.
5. Review every mark. Check that each box covers what it should and nothing it shouldn’t, such as a date the reader needs.
6. Apply the redactions and save under a new name, for example statement-redacted.pdf.
7. Check the result using the tests below before sending it to anyone.

Finding PAN, Aadhaar, phone numbers and emails

Long documents often repeat the same details: an account number on every page of a statement, an email address in each footer, a mobile number in a signature block. Searching is more reliable than scrolling.

In Pyrbit’s Redact tool, Find & Mark lets you type a word or phrase, such as a person’s name, and also pick built-in patterns: emails, phone numbers, card numbers, dates, Aadhaar numbers and PAN numbers. Every match is marked with a redaction box, which you can review and remove individually before applying.

What searching can miss

Pattern search is a strong first pass, not a guarantee. Look out for:

• Scanned pages. A scan has no text to search, so search finds nothing. Either mark those areas by hand, or run OCR first so the page has recognisable text, then search.
• Unusual formatting. A number split across two lines, written with unusual spacing, or partly in words may not match a pattern.
• Handwriting and stamps, which are pictures and need manual boxes.
• Details in images, like a photo of an ID card pasted into the document.
• Indirect clues. Removing a name but leaving a unique job title, address or photograph can still identify a person.

Tip for Aadhaar: if you only need to prove your Aadhaar for a purpose that doesn’t require the full number, UIDAI lets you download a masked Aadhaar showing only the last four digits. That can save you from redacting altogether.

How to check that redaction worked

Never assume. These checks take two minutes:

1. Search the redacted file for each removed name and number. You should get no results.
2. Select all and paste. Select all text on each redacted page, copy, and paste into a plain text editor. The removed text must not appear.
3. Extract the text. Running the file through PDF to Text shows every character the PDF still contains, in one place that is easy to scan.
4. Zoom in on the edges of each box. Tops of tall letters or bottoms of descenders sometimes peek out.
5. Try clicking the boxes. A real redaction cannot be selected and moved like an annotation.

Don’t forget the parts you can’t see

Information can hide outside the page content:

• Metadata. The document’s Title, Author, Subject and Keywords fields often contain names, and some software stores extra details in XMP metadata. Pyrbit’s Edit PDF Metadata tool lets you view these fields and remove all document information, including XMP metadata.
• Comments and annotations on pages, including ones that are collapsed or hidden.
• Bookmarks, which may be titled with a person’s name.
• Form fields, whose values may still be stored even if the visible field is covered.
• Attachments embedded in the PDF.
• The file name itself, such as Ramesh_Kumar_PAN.pdf.

Before sharing a sensitive file, check each of these, then run the content checks one more time on the final version.

When converting to images is worth it

For a document with many scanned pages, stamps and handwriting, a belt-and-braces approach is to redact, then convert the pages into flat images. Nothing selectable remains, so there is no hidden text left to leak. The trade-off is that the result can no longer be searched or copied, and it is usually larger. For ordinary typed documents, proper redaction and the checks above are enough.