The most consequential mistake in this whole subject is also the most intuitive one: drawing a black box over the words.
Why the black box fails
A PDF page is a stack of drawing instructions. Adding a filled rectangle appends one more instruction: draw a black shape at these coordinates. It does not modify or remove the instructions that came before it.
So the text is still there in full. Select across the blacked-out area and it highlights. Copy and paste it and the words appear. Open the file in an editor and delete the rectangle and the text is simply visible again.
This is not an obscure exploit. It requires no tools beyond a PDF reader and takes about five seconds. It has caused real disclosures at law firms, government departments and news organisations, repeatedly, over two decades.
What counts as covering rather than removing
| Method | Removes the text? |
|---|---|
| Black rectangle or shape | No |
| Black highlighter annotation | No |
| Drawing tool in an annotator | No |
| White box with white text over it | No |
| A dedicated Redact tool, applied | Yes |
| Rendering to images and rebuilding | Yes |
| Deleting the text and re-saving | Sometimes — incremental saves retain it |
That last row is a real trap. A PDF can be saved incrementally, appending changes rather than rewriting the file, so deleted content can survive inside an earlier revision within the same document. Always use Save As rather than Save when removing something.
A dedicated redaction tool
Acrobat and several other editors have a genuine Redact feature, and it works in two stages that people frequently confuse.
First you mark areas for redaction. At this point nothing has been removed — the marks are annotations, and the document is exactly as exposed as before. Then you apply the redactions, which is the step that actually deletes the content and rasterises the affected regions.
Sending a document where redactions were marked but never applied is a distinct and very common failure. The marks look identical to applied redactions on screen. If you use this route, apply, save as a new file, and then verify by trying to select text in the redacted area.
The method that always works
Without a dedicated tool, destroying the text layer is reliable because it removes the possibility rather than the visibility.
- Render the pages to images at 200 DPI with PDF to JPG. There is now no text layer anywhere in the document.
- Black out the sensitive areas in any image editor. You are painting pixels, so what you cover is genuinely gone.
- Rebuild the PDF with JPG to PDF.
- Verify: try to select text anywhere in the result. Nothing should select.
The cost is the text layer — the document is no longer searchable or accessible to a screen reader, and the file is larger. For a document being disclosed once to one recipient, that is a reasonable trade. Work on a copy; you want the original intact.
What people forget to redact
The visible page is not the only place information lives.
- Metadata. Author, title, producing software, and sometimes the full local file path of the original — which can name a person and a client. Covered in PDF metadata: what it reveals.
- Bookmarks and the outline, which often quote section headings verbatim.
- Annotations and comments, stored separately and easy to overlook.
- Attachments, which a PDF can carry as embedded files.
- Form field values, retained even when the field is not visible.
- Earlier revisions, if the file was saved incrementally.
Rendering to images and rebuilding discards all of it as a side effect, which is a genuine advantage of that route over surgical redaction.
Verify before it leaves
Three checks, thirty seconds, and they catch essentially every version of this mistake.
- Select across the redacted area. If anything highlights, the text is still there.
- Search for a word you redacted. Ctrl+F. No result is what you want.
- Check the file size. If it barely changed after redacting several pages, the content probably was not removed.
For anything with legal or regulatory weight, have a second person run those three checks. Every published redaction failure passed the author's own review — that is precisely the shape of the mistake.
Frequently asked questions
Why is a black box not redaction?
Because it is one more drawing instruction on top of the page, not a modification of what is underneath. The text remains selectable and copyable, and deleting the rectangle reveals it. It takes about five seconds and no special tools.
How do I redact a PDF for free?
Render the pages to images at 200 DPI, black out the areas in any image editor, then rebuild the PDF from the images. That destroys the text layer entirely, so there is nothing left to recover. Verify by trying to select text in the result.
I used the Redact tool — is that enough?
Only if you applied the redactions. Marking areas creates annotations and removes nothing; applying is the separate step that deletes content. Marked-but-unapplied redactions look identical on screen and are a very common disclosure failure.
What else should I remove besides the visible text?
Metadata including author and embedded file paths, bookmarks that quote headings, annotations, attachments, form field values, and any earlier revisions retained by incremental saves. Rendering to images discards all of it at once.
How do I check a redaction worked?
Select across the redacted area — nothing should highlight. Search for a word you removed — no result. Check the file size changed. For anything with legal weight, have a second person do it; every published failure passed the author's own review.
Does redacting make the file smaller?
Proper redaction usually makes it slightly smaller, since content is removed and regions are rasterised. If you redacted several pages and the size barely moved, that is a warning sign that nothing was actually removed.