To redact a PDF online for free, open the file in the Redact PDF tool, mark the text and areas that must be removed, apply a true redaction, and download the cleaned copy. True redaction deletes the underlying text and image data, so the sensitive information cannot be recovered by copying, searching or editing the file afterwards. That is fundamentally different from drawing a black rectangle over text, which hides it visually while leaving the original words intact underneath, ready to be copied by anyone who selects the text or removes the rectangle. The distinction is the whole subject of this guide, because a fake redaction can be worse than no redaction at all: it creates false confidence while leaking the very information it was meant to protect. The work happens in your browser, and your original file stays unchanged.
Why Black Boxes Fail
A black rectangle drawn over text is a visual cover, not a removal. The text beneath it remains in the PDF as selectable, searchable content, and anyone who opens the file can select the covered area, copy it, and paste the hidden words into another document. Even if the rectangle is opaque and the text cannot be seen on screen, the underlying characters are still present in the file structure, and a simple text extraction will reveal them. In some cases the rectangle itself can be deleted or moved in an editor, exposing the original text in full view. This failure has caused real disclosures in published legal, government and corporate documents, and it is entirely avoidable once the difference is understood.
The same warning applies to other visual tricks. White text on a white background, text covered by an image, text hidden behind another layer, and text with its colour set to match the page are all still present in the file. Search tools will find them, copy tools will copy them, and accessibility tools that read the document aloud may speak them. The only safe test is a content test, not a visual test: after redaction, try to search for the sensitive term, select the redacted area, and extract the text from the page. If the term cannot be found by any of those methods, the redaction is working. If it can, the file is not safe to share, however clean it looks.
True redaction works at the content level. It removes the characters themselves from the text layer, removes or replaces the corresponding image area, and rewrites the page so the removed content no longer exists in the file. The redacted area is typically shown as a black bar or a blank space, but that bar is now the content, not a cover over hidden content. That is the standard a proper redaction tool must meet, and it is the standard you should verify before sending any redacted file outside your organisation.
What Must Be Removed Beyond the Visible Text
Visible text is only the first layer. A PDF can also carry metadata, which includes the document title, author, creation software, creation date and sometimes the names of people who edited it. That metadata can reveal who prepared a document, when, and with what tools, even when the pages themselves look anonymous. A thorough redaction review therefore includes checking and clearing metadata that identifies people or reveals sensitive context, or at least deciding consciously what metadata is safe to keep.
Hidden layers are the second trap. A PDF may contain comments, annotations, tracked changes, embedded files, form field values, and alternative text for images, all of which can carry sensitive information that never appears on the printed page. A name removed from the visible text may still live in a comment, a form field may hold an unredacted value behind a redacted display, and an embedded attachment may contain the full unredacted document. Before sharing a redacted file, inspect comments, form fields and attachments, and remove or clean each one. When in doubt, flattening the file after redaction and checking the result can help, but flattening alone is not a substitute for true redaction, because it merges visible content without necessarily clearing hidden layers.
Images need the same care as text. A photograph in a PDF may show a face, a number plate, a document on a desk, or a whiteboard in the background, and redacting the caption does not redact the picture. Image areas must be truly removed or obscured at the image data level, not covered by a shape that can be deleted. Scanned pages deserve special attention, because a scanned page is a single image: redacting text on a scan means altering the image itself, and the original scan must not remain embedded elsewhere in the file.
How to Redact a PDF, Step by Step
Start from a copy of the document, and list every piece of sensitive information before you mark anything: names, addresses, phone numbers, email addresses, identification numbers, account details, and any other term that must not appear. Search the document for each term, including variant spellings and partial numbers, because a name redacted on one page but left on another is not redacted. Mark each occurrence for true redaction in the Redact PDF tool in your browser, apply the redaction, and download the cleaned copy under a new name. Then verify the result with the tests described below, check metadata, comments and attachments, and only then share the file.
Verifying a Redacted File Before Sharing
Verification is not optional for redaction, because the cost of a mistake is disclosure. Open the redacted copy and search for every sensitive term you listed, including short forms and initials. Try to select text in each redacted area and copy it elsewhere; nothing sensitive should paste out. Extract the text from the whole document and read it, looking for any term that survived in a footer, header, comment or form field. Check the document properties for metadata, and open any attachments or comments to confirm they are clean. Finally, view each redacted page at full size, to confirm the redaction bars cover the intended areas without obscuring unrelated content that the reader needs.
Keep a private record of what was redacted, without including the sensitive terms themselves in that record in a way that recreates the leak. A note such as redacted three names on pages 2 and 5, plus metadata cleared is enough for audit purposes. Store the unredacted original securely, with access limited to people who need it, and never send the original and the redacted copy together, because a recipient who receives both has no need for the redaction at all. Redaction protects a shared copy; it does not protect an original that is shared alongside it.
Tip: Never trust a visual check alone. After redaction, search for every sensitive term, try to copy text from redacted areas, and extract the full text. If a term can be found by any method, the file is not safe to share.
Fake Redaction vs True Redaction
The visual result can look identical while the safety is completely different. Test content, not appearance.
| Method | What you see | What remains in the file | Safe to share |
|---|---|---|---|
| Black rectangle drawn over text | Black bar | Full original text underneath | No, text can be copied |
| White text on white page | Blank area | Full text, selectable | No, text can be found |
| Image pasted over text | Picture covering text | Original text underneath | No, image can be removed |
| True redaction | Black bar or blank | Nothing, content deleted | Yes, after verification |
| Redaction plus metadata check | Clean pages | No hidden text or metadata | Yes, the thorough standard |
Worked Example: Redacting a Client Report for Publication
A consultancy prepares a client report for public release. Names, contact details and one account reference must be removed before publication.
| Item to remove | Where it appears | Method | Verification |
|---|---|---|---|
| Client contact name | Pages 2, 5, 9 | True redaction | Search finds no match |
| Phone and email | Page 2 footer | True redaction | Copy from area yields nothing |
| Account reference | Page 7 table | True redaction | Text extraction clean |
| Author metadata | Document properties | Metadata cleared | Properties show no name |
Redaction verification example — hover or tap each bar for details.
Common Mistakes
1. Drawing a black box and calling it redaction. The text underneath remains copyable and searchable. Use true redaction that deletes the content itself.
2. Redacting one occurrence and missing others. Names and numbers repeat in headers, footers and tables. Search the whole document for every term, including variants.
3. Forgetting metadata and comments. Author names, comments and form values can leak what the pages hide. Check properties, comments, fields and attachments.
4. Sharing the original alongside the redacted copy. A recipient with both files needs no redaction. Send only the redacted copy, and store the original securely.
5. Skipping verification because it looks clean. A clean appearance proves nothing about hidden content. Search, copy-test and text-extract every redacted file before sharing.
Key takeaway: True redaction deletes sensitive text, image data, metadata and hidden layers, so the information cannot be recovered by searching, copying or editing the file. Anything less is a cover, not a redaction, and must never be shared as if it were safe.
Frequently Asked Questions
How do I redact a PDF online for free?
Open the file in the Redact PDF tool, mark every occurrence of the sensitive information, apply a true redaction, verify the result, and download the cleaned copy. The work happens in your browser.
Is drawing a black box over text enough to redact it?
No. The text remains underneath, selectable and searchable, and the box can often be removed. True redaction deletes the underlying content.
How do I check that a redaction worked?
Search for the sensitive term, try to copy text from the redacted area, and extract the full text of the document. If the term appears by any method, the redaction failed.
What about metadata and comments in a redacted PDF?
They must be checked and cleared separately. Author names, comments, form values and attachments can all carry sensitive information that pages alone do not show.
Can redaction remove information from a scanned page?
Yes, but the image itself must be altered, because a scanned page is one picture. Check that the original scan does not remain embedded elsewhere in the file.
Should I keep the unredacted original?
Yes, securely and separately, with limited access. Never send the original together with the redacted copy.
Need a website that handles documents, downloads or enquiries cleanly? If your business needs clear tool pages, pricing and a contact flow that converts visitors into enquiries, Talk to us about your website.
For the surrounding document workflow, pair this with Flatten PDF and Compare PDF. More step-by-step tool guides live on Asad Webs blog.
Be the first to share a useful question or thought.