‹ All guides

Why Black Boxes in a PDF Don't Really Redact

Updated

It looks finished: a page full of black bars where the sensitive parts used to be. Yet “redacted” documents leak all the time, including court filings and government reports that made the news because someone copied the “hidden” text and pasted it somewhere else.

The cause is nearly always the same: the information was covered, not removed. Here’s how that happens and how to avoid it.

A PDF is made of layers

A PDF page isn’t a flat picture. It’s a stack of separate parts:

When you draw a black rectangle or a black highlight, most apps add it as an annotation, a new layer sitting above the text. On screen the words disappear. In the file, they’re exactly where they were.

Four ways covered text gets out

1. Copy and paste. Select the area under the box and copy it, or press ⌘A and ⌘C to copy the whole page. The covered words paste out in plain text.

2. Search. Anyone can press ⌘F and type a name or part of a number. The PDF viewer jumps straight to the “hidden” match.

3. Removing the box. Annotations can be selected, moved or deleted in most PDF editors, including Preview. Some apps can hide all annotations with one click.

4. Hidden copies elsewhere in the file. Even when the visible text is gone, the same value can survive in a form field, a comment, the document’s metadata, or an earlier version saved inside the file by “incremental” saving.

Scans have their own trap

Scanned documents look safer because the page is a picture. But many scanners and apps run text recognition (OCR) and add an invisible text layer behind the image so the PDF is searchable. Drawing a box on the picture hides the picture, and leaves the invisible text untouched.

Photos have a related problem. If you mark up an image and the app keeps the original underneath (as many “edit” features do so you can undo later), the unedited photo can travel with the file.

What real redaction does differently

A proper redaction tool does three things that a black box doesn’t:

  1. Deletes the underlying content. The characters are removed from the text layer, and the covered pixels in images are replaced rather than layered over.
  2. Cleans the hidden parts. Metadata, form values, comments and earlier versions that contain the value are removed or rewritten.
  3. Produces a new file. The saved document is rebuilt without the removed content, instead of adding a layer to the old one.

Preview’s Tools → Redact and Acrobat Pro’s Redact → Apply both remove content. Their weak point is the human one: you still have to find every occurrence yourself, on every page and in every format.

How to test any “redacted” PDF

Before sending, or when you receive one, open the final file and try to break it:

If any test reveals the information, the document isn’t redacted. Start again from the original, not from the leaky copy.

How Elisio handles it

Elisio was designed around this exact failure. It removes the underlying text and image content rather than drawing over it, and saves a new copy, so your original is never changed. Then, before it saves, it checks the new file by searching it again for every value you redacted, much like the tests above. If anything can still be found, the save is blocked and Elisio shows you where. It runs entirely on your Mac and has no internet access, so the documents you’re protecting never leave it.

The short version