Why a black box over PDF text isn’t redaction

A PDF is not a picture of a page. It is a set of instructions — draw this string, in this font, at these coordinates — and a rectangle drawn on top of a string is simply one more instruction. The string is still in the file, at the same coordinates, in full.

So when a tool offers “redact” and gives you a black box, the words underneath are usually still there: selectable with a mouse, extractable with any command-line tool, and visible to anything that reads the document’s text rather than looking at it. The page looks redacted to a human and is not redacted to a machine.

Test any tool in thirty seconds

This works on whatever you currently use — including Penstead. You need nothing but the file and a text editor.

1. Redact something in your usual tool and save or download the result.
2. Open the saved PDF in a normal PDF viewer, select all the text on the redacted page (Ctrl/Cmd + A), and copy it.
3. Paste into any text editor and read what you get.

If the redacted words appear in the paste, the redaction is cosmetic. If you would rather not eyeball it, pdftotext (part of poppler, and on most Linux and macOS machines already) does the same thing without ambiguity:

pdftotext redacted.pdf - | grep -i "the secret word"

A clean redaction returns nothing. Anything else is the text still sitting in the file.

Why this keeps happening to careful people

The failure has embarrassed governments, law firms and newspapers repeatedly, and not because anyone was careless. Three things make it unusually easy to get wrong:

• It looks right. Every visual check a person can perform — on screen, printed, in a screenshot — passes. The only way to see the problem is to stop looking at the document and read it.
• The word “redact” is used for both. Some tools mean “remove the content”, others mean “draw a black rectangle”, and the button says the same thing either way.
• Flattening is not removal. Exporting, printing to PDF, or flattening annotations sometimes bakes the box in and sometimes bakes it in over intact text. It varies by tool, by version, and by whether the box was an annotation or page content.

Metadata is the second half of the same problem. Text you removed from the page can survive in the document’s title, in XMP metadata, in an embedded thumbnail, or in an earlier revision if the file was saved incrementally.

What actually removes it

There are only two honest approaches. Either the text objects are deleted from the content stream, or the page is turned into an image and rebuilt so there are no text objects left to find.

Penstead does the second. A page carrying a redaction is rendered to a bitmap at 2×, the redacted areas are painted out on that bitmap, and the page is replaced with the flattened result — so the original text and vector objects no longer exist in the output. Pages with no redactions are copied through untouched, which is why the rest of the document keeps its selectable text and small file size.

The cost is honest and worth stating: a redacted page becomes an image, so its text is no longer selectable and the file is larger. That is the trade — the same trade that makes the removal real. It all runs in your browser, so the document you are redacting is never uploaded to us in the first place.

Try it on the file you were about to send — then run the test above on the result, and on whatever you were going to use instead.