Why black-box PDF redaction fails

Every few years a story circulates: a sensitive document is released with the key passages "blacked out", and within hours someone copies the black bars, pastes them into a text editor and reads what was underneath. It happens because many people redact a PDF the way they would with a marker on paper. On a screen, that doesn't work.

A PDF page is a list of instructions

A PDF does not store a picture of a page (unless it was scanned). It stores drawing instructions in order: set this font, show these characters at this position, draw this line, paint this image. A viewer carries them out from top to bottom and you see the result.

BT /F1 12 Tf 72 700 Td (Account number: 4417 1234 5678) Tj ET
0 0 0 rg 70 695 220 16 re f

The first line writes the text. The second paints a black rectangle over it. The viewer shows black, but the file still contains the first line, in plain readable form (or compressed in a way every PDF library can open).

The ways it leaks

• Copy and paste. Select across the box and paste. The characters under it come with you.
• Text extraction. Search engines, indexers and tools like pdftotext read the text layer and ignore what is painted on top.
• Removing the shape. In an editor, the rectangle is an object. Click it, press delete, and the words appear.
• Annotation "redactions". Highlight and comment tools often add the box as an annotation, a separate layer that can be switched off.
• Transparency. A box at 99% opacity still reveals the words when contrast is stretched. Many "dark grey" boxes are not fully opaque.
• Everything else. Bookmarks, form-field values, alt text, document properties and earlier saved versions can all repeat the text that you covered.

What real redaction means

Redaction means removing the underlying data, not covering it. There are two sound ways to do it:

1. Edit the content stream so the text instructions in the box are deleted, and remove other copies (metadata, bookmarks, forms). This keeps the document searchable but is complicated, and needs a tool that is designed for it.
2. Flatten to images. Render each page to pixels, paint black over the pixels and rebuild the PDF from those. Since pixels have no concept of "the text under here", there is no hidden layer to find. It is blunt but easy to reason about and very hard to get wrong.

Our PDF redaction tool uses the second approach and then verifies the result by trying to extract text from the output.

A quick test for any redacted PDF

1. Open it and press Ctrl/⌘ + F. Search for a word you redacted.
2. Try to select text across a black box and paste it into a note.
3. If you can, run a text extractor and read the output.

If any of those turn up the hidden words, the redaction was cosmetic. If the file is fully flattened, you will find nothing, because no text exists.