Redaction that actually works

Every year, a court filing, a government report or a corporate disclosure goes out with black rectangles over names that anyone can read in ten seconds. The pattern is always the same, and it is worth understanding properly, because the mistake is completely invisible to the person making it.

What goes wrong

A PDF page is a list of drawing instructions: put this glyph here, draw this rectangle there. Adding a black rectangle over a name appends one more instruction to that list. It does not remove the instruction that draws the name.

On screen, the rectangle covers the text and the job looks done. Underneath, the characters are exactly where they were. Select the area and copy it, and the name comes out. Extract the text layer, and the name is in it. Open the file in almost any editor, and the rectangle can simply be deleted.

Nothing about the visual result tells you which of these two things you have done. That is what makes it dangerous.

What removal requires

Genuine redaction means destroying the content, then covering the space. There is no way to make text unreadable while leaving it in the file.

That has an unavoidable consequence: to remove a word from a page, the page has to be rebuilt. In practice this means rendering it as an image, painting out the sensitive areas, and replacing the original page with that image. The removed text is gone, and so is all the other text on that page, because it is now a picture.

Any tool that offers to remove text while keeping the page fully searchable is doing something you should look at closely.

The other places information hides

Redacting the visible text is necessary but not sufficient.

Metadata carries the author's name, the software used, timestamps, and frequently the original file path, which can include a client name or a matter number. Clear it separately.

Comments and annotations survive export more often than people expect, and are not part of the page text.

Attachments can be embedded inside a PDF and never appear on any page.

Cropped content is hidden, not deleted. Cropping adjusts which part of the page is displayed; resetting the crop box brings the rest back.

How to check your work

Do not trust the appearance. Extract the text from the finished document and search it for the words you removed. This takes a minute and is the only verification that means anything.

If a name you redacted appears in that extracted text, the redaction failed, no matter how convincing the page looks.

The simplest safe option

Where practical, produce a version of the document that never contained the sensitive information, rather than removing it afterwards. Redaction is a repair; not writing it down is a design.

Why the mistake is so persistent

Because nothing about the result looks wrong. The page shows a black rectangle over a name; the name is invisible; the job appears done.

Everything that would tell you otherwise is in a layer you have to go looking for. Unless you extract the text and read it, the failed redaction and the successful one are indistinguishable.

It also happens to be a task that arrives under time pressure, performed by someone who is not a document specialist, on a deadline. Those are the conditions under which people trust appearances.

The other ways it fails

Cropping instead of removing. Cropping changes which part of the page is displayed. Resetting the crop box brings the rest back.

Covering with a white shape. The same failure as a black box, with the added charm of being invisible to the person checking.

Deleting text in an editor that leaves it in the revision history. Incremental saves append rather than rewrite, so the earlier state is still in the file.

Removing a page but not its bookmark, which then names what was on it.

What good practice looks like

Work from a copy, and keep the unredacted original somewhere controlled. You will need it if a dispute arises about what was removed.

Redact, then flatten, then clear the metadata, then extract the text and read it. In that order, because each step can reintroduce something the previous one removed.

Where a document will be disclosed to several parties with different entitlements, produce a separate version for each rather than one heavily redacted version for all. It is more work and considerably safer.

The version that avoids the problem

Where practical, produce a document that never contained the sensitive information rather than removing it afterwards.

Redaction is a repair applied to a document that was written without disclosure in mind. If you know at the outset that something will be shared, drafting it so the sensitive material sits in a separate annex is faster, safer, and does not depend on anyone remembering to check the text layer.