How to Redact a PDF
Select the PDF, draw rectangles over content that must not remain visible, review every page, and create a secure flattened output. During export the source page is rendered, the rectangles are painted into the pixel data before image encoding, and a completely new PDF is created from those sanitized page images.
Why Black Boxes Alone Are Not Secure
A normal PDF rectangle can hide text visually while leaving the underlying text object, form field, annotation or image in the file. Someone may still copy, search or remove the overlay. That is why this tool does not use an overlay-only save mode for security redaction.
How Secure Flattened Redaction Works
Each page is rasterized at the selected quality. Redaction regions are expanded slightly at render scale to cover anti-aliased character edges and painted as fully opaque pixels. The sanitized image is then embedded on a fresh PDF page with the original visible dimensions. Source content streams are not copied.
Redact Text and Images
The same region can cover text, photographs, signatures, account numbers or any other visible material because the final operation is pixel-based. Manual review is essential: the tool does not automatically claim to detect every sensitive name, email address or financial identifier.
What Happens to Searchable Text?
The secure output intentionally contains no original selectable page text layer. Links, forms, annotations, bookmarks, attachments and existing signatures are also not preserved by the rebuilt-page process. If searchable non-sensitive text is needed later, OCR should be performed on the sanitized output after careful review.
Redaction vs Whiteout and Cropping
Whiteout in a normal editor is only a visual cover. CropBox cropping changes the visible region but can leave hidden content inside the file. Secure flattened redaction is different because it constructs new page images after sensitive pixels are overwritten.
Digital Signatures and Redaction
Redaction changes the document and the secure rebuild does not carry original signature objects. Any prior cryptographic signature no longer represents the redacted file. Keep the original signed version separately if records management requires it.
Browser Privacy
Pages are rendered and sanitized in the browser. Redaction coordinates and original page images are not uploaded. Large documents can use significant RAM, especially at 300 DPI, so processing is sequential and high-resolution canvases are released after each page.
Why Redaction Is a Security Operation
Redaction is different from annotation because the objective is not merely to change appearance. Sensitive source information must not be available behind the mark in the delivered copy. A PDF can contain text objects, alternate layers, forms, comments, attachments and metadata that are invisible in a simple screenshot of the viewer. Secure redaction must therefore be designed around what is carried into the output, not just what the user sees on screen.
The Sanitized-Page Reconstruction Model
The production workflow deliberately takes a conservative route. For every source page, PDF.js renders the visible page at the selected resolution. Redaction rectangles are expanded slightly at render scale and painted as fully opaque pixels before that image is encoded. The sanitized image is then embedded on a newly created PDF page with the same visible dimensions. Original page objects are not copied.
This means the output cannot retain the original hidden text under a black rectangle because that text object was never imported. It also means forms, hyperlinks, annotations, bookmarks, attachments, optional content and existing digital signatures are normally lost. The tradeoff is intentional and is presented in the interface before export.
Choosing Redaction Quality
Recommended mode targets approximately 200 DPI, which is generally suitable for ordinary office documents. High Quality uses a higher target when browser memory permits, while Smaller File lowers resolution. The page is still sanitized in every mode; the quality setting changes rendered detail and JPEG size, not whether the redaction rectangle is opaque.
Large documents should be processed page by page. Keeping dozens of 300-DPI canvases in memory would create unnecessary crash risk. The implementation renders, sanitizes, encodes and releases each page before moving to the next.
Reviewing Redaction Areas
Manual review remains essential. A rectangle may be moved or resized before export, and keyboard users can adjust selected regions without relying exclusively on dragging. The tool does not claim local AI automatically finds every name, phone number, account identifier or confidential phrase. Users should review the complete page, including headers, footers and images.
Why Text Extraction Is Checked After Export
The secure output is intentionally image based and should contain no original page text layer. After saving, the browser reopens the generated file and requests text content from every page. If unexpected extractable text exists, the operation is treated as a security validation failure rather than a success. The QA fixture also contains a known secret phrase so the sanitized reconstruction can be independently checked for absence of source text.
Redaction and Metadata
Creating a fresh PDF makes it possible to avoid copying source author, subject, keywords, attachments or JavaScript by accident. The output uses minimal generic metadata. This does not guarantee that a human reviewer has removed every sensitive fact visible in unredacted pixels, so document classification and final review are still required.
What to Keep After Redaction
Organizations often need both the restricted original and a sanitized distribution copy. Treat the redacted PDF as a new document. Existing digital signatures from the source do not carry over, and a downstream OCR operation should only be run on the already-sanitized output if searchable non-sensitive text is required.
Redaction Review Checklist
Before exporting, inspect each page at a useful zoom and look beyond the obvious target phrase. Names can appear in headers, repeated tables, footnotes, images, QR codes or handwritten notes. If a redaction touches the edge of a character or image, enlarge the rectangle rather than relying on precise anti-aliased boundaries. The export process adds a small pixel safety margin, but user selection still defines what content is removed.
After download, open the redacted copy as a separate file and try normal search or text selection. Because the secure output is image based, original text should not be selectable. Also review page count and visible dimensions. If the document must later be searchable, OCR the sanitized copy—not the confidential source—so the new text layer is derived only from pixels that survived redaction.
Do not overwrite the only source copy during a redaction workflow. Secure redaction intentionally destroys information in the distribution copy. Records-retention policies may require the restricted original to remain available to authorized custodians while the redacted derivative is shared more broadly.
Frequently Asked Questions
Is drawing a black box enough?
No. A normal overlay can leave underlying source content in the PDF.
How is secure redaction saved?
Each page is rendered, redaction pixels are painted before encoding, and a new image-based PDF is built.
Can redacted text be copied?
The secure output intentionally has no original page text layer.
Does redaction flatten the PDF?
Yes. Searchable text, links, forms, annotations, bookmarks and signatures are normally lost.
Can I redact multiple pages?
Yes. Regions are stored independently for each page.
Does redaction affect digital signatures?
Yes. The rebuilt output does not preserve the original cryptographic signature.
Are pages uploaded?
No. Rendering and rebuilding are browser-side.
Can I use OCR after redaction?
Yes, but run OCR on the sanitized output, not the original, and review the OCR layer before distribution.