How to redact a PDF properly (the black box isn't enough)
Drawing a black box over sensitive text doesn't remove it, the words are still underneath. Here's why that fails, and a genuinely safe way to redact a PDF in your browser.
You need to share a document but hide a few sensitive lines, a salary, an address, someone’s name. So you draw a black rectangle over the text and send it off. It looks redacted. It is not. This exact mistake has leaked court filings, exposed informants, and embarrassed governments, because the words are still sitting in the file, right under the box.
If you’ve ever blacked something out and assumed it was gone, this one’s worth two minutes.
Why a black box fails
A PDF keeps its content in layers. The text is one thing; a shape drawn on top is another. When you place a black rectangle over a sentence, you’ve added a graphic above the words, but you haven’t touched the words themselves. They’re still there, as real, selectable text, hidden only visually.
Anyone can get them back, and it’s not hacking. Select the area and copy. Or run the file through a text extractor. The “hidden” text comes straight out, box and all. The black rectangle fooled your eyes, not the file.
You can prove this to yourself. Take a PDF where something’s been covered with a box and extract its text. The supposedly redacted words show up in the output, because they were never removed. That’s the test, and it’s also the warning.
The same trap with metadata
Even when the visible text is dealt with, a document can leak through its metadata, the hidden properties carrying an author name, edit history, and more. Real redaction means thinking about what’s hidden in the file’s structure too, not just what’s on the page.
A genuinely safe way to redact, in your browser
The reliable principle: don’t cover the text, destroy it. If the sensitive words no longer exist as text in the file, there’s nothing to recover. Here’s a way to do that with browser-based tools, nothing uploaded:
- Cover the sensitive parts. Place a solid block over each piece of text you need gone, so it’s hidden visually. On its own this isn’t safe yet, it’s the next step that matters.
- Flatten the pages to images. Convert the document to images with PDF to images. This turns each page into a flat picture. The crucial effect: the text stops being text and becomes pixels. Whatever was under your block is now just part of an image, and the block is painted permanently over it.
- Rebuild the PDF. Turn those images back into a PDF with images to PDF. You’ve got a document again, but one where the redacted text genuinely no longer exists as recoverable text.
- Verify. Run the result through extract text. If the sensitive words don’t appear, they’re truly gone. This check is the whole point, do it every time.
One trade-off to know: flattening to images removes the real text layer from the entire document, so the whole thing becomes a picture and is no longer searchable. That’s exactly why the hidden text can’t be recovered. If you need the rest of the document searchable, you can OCR it afterward, which rebuilds a text layer from what’s visible, and the redacted areas, now just black pixels, have nothing for OCR to read.
Why this has to stay on your machine
Think about what you’re redacting: it’s sensitive by definition, that’s the reason you’re hiding it. Uploading that document to an online “redaction” tool means handing the unredacted original, sensitive text fully intact, to a stranger’s server. The thing you’re trying to protect is exposed in the very act of protecting it.
reader.me runs in your browser. Every step above happens on your own device: the file is read into memory locally, processed there, and saved back to you, with nothing uploaded. You can confirm it with developer tools (F12) on the Network tab, or by doing the whole thing offline.
Since August 2026 you no longer have to do this by hand: the redact a PDF tool marks the areas and rebuilds the page without what was underneath, in your own browser. The manual route above still works if you prefer to control every step.
Real redaction is about removal, not concealment. A black box hides text from your eyes; flattening removes it from the file. Do it locally, verify with a text extraction every single time, and you can share a document knowing that what you hid is actually gone.