There is a specific, repeated, very public failure mode in document handling: someone opens a PDF, draws filled black rectangles over the sensitive passages, saves, and publishes. The passages are then recovered by anyone who selects the page and pastes it into a text editor.
It has happened in court filings, government disclosures and corporate reports. The people involved were not careless with the concept of redaction; they misunderstood what a PDF is.
Why the black box fails
A PDF page has layers of drawing instructions. The text instruction says draw the glyphs "Account 4471-8890" at these coordinates. When you add a rectangle, you append a new instruction: fill this area with black.
The rectangle is drawn on top. The text instruction is still there, unchanged. A PDF viewer renders the black box over the letters, but the letters remain in the content stream, and:
- Select-all and copy extracts them, because text extraction reads the stream, not the rendered pixels.
- Search finds them.
- Any text-extraction tool dumps them in plain sight.
- Removing the annotation, if the rectangle was added as an annotation rather than page content, restores the page instantly.
The same trap applies to white boxes, highlighter shapes, and "hiding" content by moving an image over it.
What real redaction does
Proper redaction removes the underlying content, not just its appearance. That means:
- Deleting the text operators for the redacted region from the content stream, so there is nothing left to extract.
- Cropping or replacing image data in that region, if the sensitive material is part of a scan.
- Drawing an opaque mark so a reader can see that something was removed, this part is cosmetic, but it is the honest signal.
- Clearing metadata, because document properties, XMP records and edit history frequently carry the author's name, the original filename and sometimes a full revision trail.
- Removing annotations and comments, which live outside the page content and are routinely forgotten.
The blunt method that always works
If the document is going to a stranger and the stakes are high, there is a crude technique that cannot fail: flatten the page to an image.
Convert the PDF pages to images, apply the black marks to the images, then rebuild a PDF from those images. Because a raster image has no text layer at all, there is nothing to extract. You lose selectable text and searchability for the whole document, and the file gets larger, but the redaction is unarguable.
Use this when the document is short, the recipient is adversarial, or you cannot verify the tooling.
Verifying your redaction
Never trust the visual result. Run these three checks on the output file:
- Select all, copy, paste into a plain text editor. Read what comes out. If any redacted string appears, the redaction failed.
- Search the document for a distinctive redacted term, a surname, an account number.
- Inspect the metadata. Author, title, producer, creation and modification timestamps often reveal more than people expect.
If all three come back clean, the content is gone.
What redaction cannot fix
- Context. Redacting a name but leaving "the CFO of a 40-person firm in Ahmedabad" identifies the person anyway. Statistical re-identification is a real risk in documents with rich surrounding detail.
- Redaction shape. A black box whose width matches the text tells a reader how long the removed word was. For a short field like a name or a country, that narrows things considerably. Use uniform-width marks where it matters.
- Other copies. Redacting your outgoing PDF does nothing about the original sitting in an email thread.
Doing it without handing over the document
There is an obvious irony in uploading a document to a third-party server precisely because it contains material too sensitive to share. Redaction is the one operation where local processing is not a nice-to-have.
NextTool's PDF redaction tool removes the underlying content in your browser and never transmits the file; the flatten and metadata tools cover the other two steps. Whatever tool you use, run the copy-paste test on the result before it leaves your machine.