Why Drawing Black Boxes on a PDF Doesn't Actually Redact Anything

You have a PDF with sensitive information — a Social Security number, a bank account number, a salary figure. You open it in a PDF editor, draw a black rectangle over the text, save the file, and send it off. It looks redacted. The text is hidden behind a solid black box.

But the text is still there.

This is the most common redaction mistake, and it has caused some of the most embarrassing data leaks in recent history. Understanding why this happens — and how to actually redact a PDF — takes about five minutes and could save you from a serious privacy breach.

The Problem: PDFs Have Layers

A PDF is not a flat image. It's a structured document with multiple layers — text, images, annotations, form fields, metadata, and more. When you open a PDF in an editor like Adobe Acrobat, Preview, or any number of free tools and draw a black rectangle, you're adding a shape annotation on top of the existing text layer.

The original text is still embedded in the file, intact and unchanged. The black box is just sitting on top of it, like a sticky note covering a word on a printed page. Anyone can:

• Select and copy the text underneath the black box (Ctrl+A, Ctrl+C)
• Search for the hidden text using Ctrl+F or the search function
• Remove the annotation in any PDF editor that supports editing annotations
• Extract the text programmatically with tools like pdftotext, Python's PyPDF2, or even JavaScript

This isn't a theoretical vulnerability. It has caused real, high-profile data leaks.

Real-World Redaction Failures

These are just the high-profile examples. Improper redaction happens constantly in legal filings, HR documents, insurance claims, and everyday business communications. Most of the time, nobody checks — but when they do, the consequences can be severe.

What Real Redaction Looks Like

True PDF redaction doesn't just cover text — it destroys it. The underlying text must be permanently removed from the file so that no tool, no matter how sophisticated, can recover it.

There are two approaches that actually work:

1. Proper Redaction Tools (Adobe Acrobat Pro)

Adobe Acrobat Pro has a dedicated "Redact" tool (not the rectangle tool, not the highlight tool — the specific redaction feature). When you use it, Acrobat marks areas for redaction and then applies the redaction in a separate step, which permanently destroys the underlying text, images, and metadata in those areas.

The key word is "apply." Marking text for redaction is not the same as redacting it. You must click "Apply Redactions" to actually remove the data. Many people skip this step, leaving the redaction marks as removable annotations — exactly the same problem as black boxes.

The downside: Acrobat Pro costs $23/month. Most people don't have it.

2. Flatten to Image (The Foolproof Method)

The most reliable approach is to flatten each page of the PDF into an image. This process:

1. Renders the page visually (exactly as it appears on screen)
2. Draws your redaction boxes over the sensitive areas
3. Converts the result to a flat image (PNG)
4. Rebuilds the PDF using those images as pages

Because the output is an image, there is no text layer, no annotation layer, no hidden data. The redacted areas are just black pixels — there's nothing underneath them to recover. The original text has been physically destroyed during the rendering process.

This is the method that Safely Redact uses. When you export a redacted PDF, every page is flattened to a high-resolution image (150 DPI by default, 300 DPI optional). The original text data is gone — permanently, irreversibly, with no possibility of recovery.

How to Check if a PDF Is Properly Redacted

If you receive a "redacted" PDF — or want to verify your own redaction — here's how to check:

1. Try Ctrl+A (Select All) — If you can select text behind the black boxes, the redaction is fake.
2. Try Ctrl+F (Find) — Search for a word you know should be redacted. If the search finds it, the text is still there.
3. Try copy-paste — Select the area behind a black box, copy it, and paste into a text editor. If text appears, it's not redacted.
4. Check with a command-line tool — Run pdftotext document.pdf - and see if the "redacted" text appears in the output.

If any of these tests reveal hidden text, the PDF is not properly redacted and should not be shared.

Common Tools That Do NOT Properly Redact

These tools let you draw shapes over text but do not remove the underlying data:

• macOS Preview — The rectangle and highlight tools are annotations, not redactions
• Microsoft Word (highlight + export to PDF) — Highlighting doesn't remove text from the PDF output
• Google Docs — No redaction feature; drawing a black box creates an image overlay, but text may still be extractable
• Free online PDF editors — Most add shapes as annotations on top of the text layer
• Adobe Acrobat Reader (free version) — The free reader has no redaction capability; any markup tools are just annotations

The Bottom Line

If you're sharing a PDF that contains sensitive information, "covering up" text with a black box is not redaction. It's the digital equivalent of holding your hand over a piece of paper — it works until someone moves your hand.

Real redaction either uses a dedicated redaction tool that destroys the underlying text (like Adobe Acrobat Pro's redaction feature) or flattens pages to images so that no text layer exists in the output file.

For most people, the flatten-to-image approach is the safest option. It's impossible to get wrong — there's simply no text data left in the file to recover.