How to Redact a PDF Properly (Not Just Draw a Black Box)

Key takeaways

• Drawing a black or colored shape over text with an annotation or markup tool only covers it visually — the original text objects typically remain in the file underneath, selectable and extractable.
• Real redaction deletes the underlying text and image data from the page's content stream, not just its on-screen appearance.
• A redacted PDF should also be checked for leftover sensitive data outside the visible page — metadata, comments, and attachments aren't touched by redacting page content.
• Redaction should be performed on a copy of the file, never the original, since removing content is a one-way operation.
• Flattening a PDF is not the same as redacting it — flattening merges annotations into the page but doesn't guarantee the covered content underneath is actually gone.

If you’ve ever redacted a document by drawing a black rectangle over a paragraph with a PDF annotation tool, it’s worth checking whether that actually worked — because for a lot of tools, it didn’t. The black box sits on top of the page. The text it’s covering is usually still there.

Why a black box often isn’t real redaction

A PDF page isn’t a flat image — it’s a set of objects: text runs, image data, vector shapes, all positioned on the page. When you use a highlighter, shape, or “draw” tool to put a black rectangle over a sentence, that rectangle is typically added as a new object on top of the existing ones. The text underneath doesn’t move or disappear; it’s just visually obscured by whatever you drew over it.

That has a few consequences:

• Select-all or copy-paste can pull the covered text out anyway, since the text objects are unchanged and still there in the content stream — the black shape doesn’t block selection, only visibility.
• Searching the document (Ctrl+F / Cmd+F) can still match the “redacted” text, because search reads the underlying text layer, not what’s rendered on screen.
• Some viewers let annotations be hidden or toggled off entirely, which can re-expose the original content without editing the file at all.

None of this requires anything sophisticated to expose — often just selecting text or opening the file in a different viewer is enough.

What real redaction actually does

A proper redaction tool works at the content level, not the annotation level:

1. It identifies the actual text and image objects located in the area you’ve marked (or matching a search term, in tools that support keyword-based redaction).
2. It removes those objects from the page’s content stream — not just covers them.
3. It draws a black (or custom-colored) box in their place, purely as a visual marker that content was removed.

The visual result can look identical to the black-box method. The difference is entirely in what’s left in the file afterward: nothing, versus the original content sitting one selection away.

How to redact a PDF correctly

1. Work on a copy of the file, not the original. Redaction is destructive by design — once done correctly, the removed content is gone. Keep an unredacted original somewhere separate in case you need it later.
2. Open a redaction tool built for the job, such as Stirling PDF’s redact tool, rather than an annotation or markup feature in a general PDF viewer.
3. Mark the areas or terms to redact. Depending on the tool, this might mean drawing boxes over specific regions or entering keywords to redact every occurrence automatically.
4. Run the redaction. This is the step that actually deletes the underlying content, rather than just placing a shape over it.
5. Download the result and verify it before sending it anywhere — see the checks below.

Don’t stop at the visible page

Removing text from a page’s content stream handles what’s printed in front of you, but a PDF can carry sensitive information outside the page itself:

• Metadata — author name, company, or software details set in the document properties. Worth reviewing with a metadata tool if the document’s origin shouldn’t be traceable.
• Comments and annotations — notes or replies left by previous reviewers, which may reference exactly what was redacted and why.
• Embedded attachments or scripts — a sanitize tool strips embedded JavaScript and other risky elements that redaction alone won’t touch.

If the goal is closer to “nobody without permission should open this file at all” rather than “this specific paragraph shouldn’t be visible,” a password is the more direct tool — redaction and encryption solve different problems and are often used together.

Verifying the redaction actually worked

Before sending a redacted file anywhere, spend thirty seconds checking it the way someone trying to recover the content would:

• Try selecting text under the black box. If a cursor drag highlights anything, the underlying text is still there.
• Search for the redacted term with Ctrl+F / Cmd+F. A proper redaction won’t return a match.
• Open the file in a second, unrelated viewer, in case the first one is silently hiding rather than removing the content.

Since a document worth redacting is usually sensitive by definition, it’s also worth applying the same scrutiny to the tool itself — check what happens to the file during processing, the same questions worth asking about any PDF tool handling sensitive files.

Redaction is one of the few PDF operations where “looks right” and “is right” can genuinely diverge. Confirming the text is gone, not just covered, is the difference between the two.