Why Drawing a Black Box Over a PDF Isn't Redaction
Black rectangles drawn over PDF text often leave the text intact underneath. Here is why redactions fail, how to check a document, and what real redaction does.
It looks redacted. The names are behind solid black bars. But select the text, copy, paste it into a note, and everything is still there.
This failure has exposed confidential details in court filings, government reports and corporate documents for years. In a widely reported 2019 case, lawyers for Paul Manafort filed a document whose "redacted" passages could be read by copying and pasting the text. It keeps happening because of how PDFs work.
Why black boxes fail
A PDF is not a picture of a page. It is layers of objects: text, images, vector shapes and annotations, each drawn on top of the last.
When you draw a black rectangle with a highlighter, shape or comment tool, you add another object on top. The text underneath is untouched. Viewers display the box over it, but:
- copy and paste still selects the hidden text
- search still finds it
- screen readers still read it aloud
- text-extraction tools ignore the box entirely
- the annotation can simply be deleted
Changing the text colour to black, or setting the highlight colour to black, fails in the same way.
Other places sensitive data hides in PDFs
- Document metadata: author name, organisation, the software used, creation and modification dates, sometimes the original file path.
- Previous versions: PDFs can be saved incrementally, keeping earlier content inside the file.
- Hidden layers and form fields that are not visible on screen.
- Bookmarks, comments and attachments.
- The original image behind a cropped or covered picture.
How to check a "redacted" PDF
- Try to select or copy text inside a black bar.
- Search the document for a word you know was redacted.
- Open the document properties and look at the author and metadata fields.
- If in doubt, assume the redaction failed.
What real redaction does
Real redaction removes the content, rather than covering it. A proper redaction tool deletes the underlying text and image data in the marked areas, removes metadata and hidden content, and saves a new, flattened file.
NoUpload's Redact PDF takes the most reliable route: you drag boxes over what to hide, and every page is flattened into an image with the boxes burned into the pixels. The new PDF has no text layer, metadata or earlier versions underneath, so there is nothing to copy out. It all happens in your browser, so the unredacted document is never uploaded. The trade-off is that the output isn't text-searchable.
Clean the hidden layers too
Redaction drawn in another app can still leave the author's name or earlier versions in the file. Before sending any PDF, run it through Remove Metadata from PDF: it shows the author, software, comments and saved versions inside the file and rebuilds a clean copy, all in your browser. If you only need part of the document, extract just those pages and send less.