Redact PDF: Remove Text for Good, Right in Your Browser

How to use the Redact PDF: Remove Text for Good, Right in Your Browser

1. Add your PDFDrop a PDF on the box, or choose it from your device. A file that is protected with a password has to be unlocked first, for example with the Unlock PDF tool on this site.
2. Find what to black outType words or phrases, one per line, and tick the kinds of data to look for. Press Find on all pages. Every match gets a box, and the page jumps to the first one. Look at each box on the page. Remove any that is wrong.
3. Draw boxes where the search cannotDrag on the page to draw a box around anything else, such as a signature, a logo, or text in a scanned page. Drawn boxes can be removed from the list under the page.
4. Choose the picture quality and press RedactSharp keeps every pixel and makes a larger file. JPEG makes a smaller one. Pick the resolution, decide whether the document properties and attached files go too, and press the button.
5. Read the checks and downloadThe page lists what was checked in the new file. If one of the words you redacted is still readable on a page that has no box, it says which page. Download the file when the checks pass.

Why a black box is not redaction

A PDF keeps the text of a page and the way it is drawn as separate things. A rectangle drawn on top, whether it is a shape, a highlight, or a comment, only adds a shape to the page. The text underneath stays in the page content, where a copy command, a text search, or a script can read it. The US National Security Agency describes redaction as the process of selectively removing visible and non-visible classified or sensitive information from a document, and its guide for Adobe Acrobat is built around the step that removes the content itself, followed by a step that removes metadata, hidden content, and scripts.

Researchers at Inria in France found the same problem on a large scale. They collected 39,664 PDF files that 75 security agencies in 47 countries had published, and in 65% of the files that had been sanitized, they still found sensitive information. The lesson is that removing data at the surface is not enough. Everything that could carry it has to go.

What this page does to a redacted page

The page is drawn in your browser by the PDF.js library from Mozilla, the one that Firefox uses to show PDFs, and the boxes are painted on it in black. The result is a picture of the page. The new file keeps the page's size and puts that picture on the page, and the old content, fonts, comments, links, and form fields of that page are not carried over. A PDF reader finds nothing on the page except the picture, so there is nothing to select, copy, or search.

Pages without a box are copied as they are, so their text stays selectable and the file stays small. The cost on a redacted page is that its remaining text is part of the picture too. If you need that page searchable after redacting, run it through an OCR program afterward. A fresh text layer made from the redacted picture can only contain what the picture shows.

Finding what to redact

Words and phrases are matched as you typed them, ignoring case unless you ask for it, and a phrase matches even when a line break falls in the middle. The kinds of data are checked by their rules, so that the page does not black out every long number. A card number has to pass the Luhn check, the check digit that the standard for card numbers uses. An IBAN has to pass the mod 97 check that ISO 13616 defines. A Social Security number must have an area, group, and serial number that can be issued, so 000, 666, and 900 to 999 as the first part are skipped. A phone number needs 8 to 15 digits with separators, and dates are not mistaken for it. Email addresses and IP addresses are found by their format. Text in form fields and comments is not part of the page text, so it is searched separately, and a field or comment that matches gets a box over the whole of it.

These are the kinds of data that court rules ask people to remove. US Federal Rule of Civil Procedure 5.2 says that a filing with a Social Security number, a taxpayer identification number, a birth date, the name of a minor, or a financial account number may include only the last four digits of the numbers, the year of the birth date, and the minor's initials. This page blacks out the whole match. If a rule lets you keep the last four digits, draw a box over the rest by hand.

Each match is turned into a box on the page. Where in a line a word sits is worked out from the width of its characters, using the widths of Helvetica and Times, scaled to the length of the line, and a margin that grows with the font size is added so that no edge of a letter is left. Fonts with other proportions, such as bold text, can move a box by a point or two, which is why you see every box on the page before you redact, and why the margin can be made wider.

What else can hold the text

The page content is not the only place a name can be. A comment on another page may quote it. A bookmark may carry it as a title. A form field keeps its value in the field, away from the page. Tags for screen readers hold a copy of each page's text. The document properties and the XMP block may name it in the title or subject. An attached file may be a whole copy of the document.

When you redact, the page replaces the pages you boxed, removes the comments, links, and form fields on them, and drops the form fields that belonged to them. It removes the accessibility tags and the article threads, since both can hold a copy of the text. It looks for every word you redacted in the rest of the file, and it removes a comment or a bookmark that holds one. The document properties and XMP can be removed with a setting, and attached files with another. Attached files are kept unless you ask, since they may be the point of the file, but the page warns you that they may hold the text.

What the check after redacting shows

The new file is opened in PDF.js a second time, from its own bytes. The page counts the text it finds on every page you redacted, which should be nothing, and it looks for each redacted word on the pages you did not box. A name that you blacked out on page 2 may be written again on page 9. That is not an error in the file, but it is something you would want to know, so the page lists it, and you can add a box and redact again.

A separate search covers the rest of the file: properties, XMP, bookmarks, comments, form fields, attached files, and any page content that is stored as plain characters. The result says either that none of the words were found, or where each one still is. The check cannot read text that a font encodes in its own way, so the second reader's view of each page is the main evidence for the pages.

How the redactor was tested

A sample PDF was made with reportlab and pikepdf, which are not part of this page. It has the same name, email address, phone number, Social Security number, card number, IBAN, and IP address in Helvetica, Times, Courier, and bold type on a page with a 90 degree rotation, plus a bookmark, a link, a form field holding the name, a comment that quotes it, an attached file, and document properties. The boxes this page made for each match were compared with the exact word boxes that PyMuPDF reads from the file. Of the 23 boxes compared, the 16 on upright pages reached 1.5 to 1.8 points past their word on both sides. On the rotated bold page, where the character widths are a guess, the worst edge fell 0.2 points short of the line box that PyMuPDF reports, and the furthest reached 6 points beyond it.

A run in Chrome then redacted pages 1 to 4 of the sample, with every kind of data ticked and one box drawn by hand. The file it downloaded was drawn with PyMuPDF and compared with the original pixel by pixel: no ink of any of the 65 blacked-out words showed, and the 77 words next to them were left alone. The redacted files were also checked with qpdf, which found no structural problem, and with PyMuPDF, which found no text on any redacted page, the same page sizes as before, one picture on each, and identical text and pixels on the page that was not redacted. The form field, the bookmark, the comment, the attached file, and the properties that named the person were gone, and when every page was boxed, the name appeared nowhere in the bytes of the file. The check for card numbers, IBANs, and Social Security numbers was run against published test numbers and against the same numbers with one digit changed.

Limits and accuracy

• A redacted page becomes a picture, so its remaining text can no longer be selected or searched. Run an OCR program on it if you need that.
• The search needs text it can read. A scanned page has none, so draw its boxes by hand. The page tells you when a page has no searchable text.
• The position of a found word is worked out from character widths, so bold text and unusual fonts can be a point or two off. Look at each box before you redact, and widen the margin if needed.
• The pictures are drawn by PDF.js, so a page may differ slightly from how another program draws it, for example when a font is not embedded in the file.
• A PDF that is protected with a password has to be unlocked first. Use the Unlock PDF tool on this site.
• A digital signature on the original does not apply to the redacted copy, because it is a new file. The page warns you when a file is signed.
• Attached files are kept unless you switch the setting on, and they may contain the text. The same goes for text hidden in the pages you did not box, such as a white-on-white line or a switched-off layer.
• Redaction removes what is in the file. It cannot remove what was already copied, indexed, or sent before. If a file with the text has been shared, treat the text as exposed.

Frequently asked questions