Securely redact a PDF
What Securely redact a PDF actually does
The failure everyone writes about is a black rectangle drawn in a viewer with the text still underneath it, where a reader can select the words through the box or ask any model to read the layer below. This page never produces that file. Every page is rasterized and a new document is built from the images, so the text layer, the metadata, the attachments, the form fields and the links do not travel with the result. That much is easy, and it is where most tools stop. The harder question is the one nobody answers: did the mark actually land on the words. A rectangle placed with the wrong geometry, on a page whose entry says it displays turned a quarter turn, or on a line whose own matrix is rotated, is still a perfectly black rectangle sitting on empty paper, and a file with no extractable text at all can still show the number in full. So the check here is not the character count, which rasterizing drives to zero whether or not a single mark was drawn. After the document is written it is opened again and each region is measured in the produced pixels: solid black or the download is refused and the failing region is named. Beside that sits a second measurement of what was under each mark in the source, because a mark over blank paper is either an invisible scan layer or a placement fault, and either way you should be told which regions those were. Everything happens in the tab. The document is never sent anywhere.
How to use it
- Choose the PDF, then say what to remove: exact phrases one per line, built-in patterns for addresses, social security numbers, telephone numbers, payment cards validated by their check digit, and network addresses, or both.
- The scan reads the text of every page and the value of every form field and note, because a field value is drawn on the page but is not part of the page text and would otherwise never be offered.
- Review the result page by page. Click a found region to include or ignore it. Where a match sits inside a longer run the page says which run will be covered, so the wider mark is a decision rather than a surprise.
- Add regions the text layer cannot reach, over a scan or a picture, by dragging on the page or by using the page's own Add region control and typing the position and size.
- Press download. The pages are rasterized, the regions are burned in, the produced file is reopened and measured, and the receipt on the page states how black the weakest region came out and how many characters remain extractable.
Useful for
- Send an exhibit to a court or an opposing party where the words removed have to be gone from the file rather than hidden in it.
- Hand a client document to a subcontractor with the account numbers taken out, and keep the receipt alongside it as the record of what was checked.
- Clear a scanned form where the sensitive value sits in a field or in an image and no phrase search will ever find it.
- Check a document a scanner or a colleague produced turned sideways, where a mark placed by page coordinates alone would sit in the wrong quarter of the sheet.
Limits worth knowing
- A mark covers the whole text run that carried the match, not only the matched characters. There is no per-glyph geometry available in a browser, and a narrower guess could leave part of the match showing, so the wider mark is deliberate and the page says when it applies.
- The result is an image. It is no longer searchable, selectable or readable by a screen reader, which is the price of the guarantee and the reason the source file should be kept.
- A phrase broken across two text runs by the way the document was written will not match as one phrase. Add a region by hand for it.
- The receipt proves that each selected region is black in the produced file and that no text can be extracted from it. It does not judge whether the regions you selected are the right ones.
- An encrypted document has to be unlocked before it can be read here.
Questions people ask
Is drawing a black box over PDF text secure?
Not by itself, and checking that the text is gone is not enough either. An overlay can leave the original text or image data in the file, and a file with no extractable text at all can still show the words if the mark was placed wrong. This tool rasterizes each page with the selected regions burned into the pixels, then reopens the file it just wrote and measures every region: solid black, or the download is refused and the failing region is named.
Will the redacted PDF still be searchable?
No. Removing all source text is the browser workflow's security boundary. The local CLI performs object-level redaction and can preserve unredacted searchable text.
Does the file leave my device?
No. Matching, page rendering, redaction, verification, and download happen locally in this tab.