In December 2025, a set of high-profile court documents was published with the sensitive names blacked out — and within hours, readers were copying the “hidden” text straight out of the file. It wasn’t a hack. It was the single most common redaction mistake, the one that turns a black box into a false sense of security. If you ever need to hide a name, an account number, an address or a signature in a PDF before you share it, this guide shows you how to do it so the information is actually gone — not just covered up.
What redaction actually means
Redaction is not “covering up” sensitive text. It is removing it, permanently, so no one can recover the original — not by copying, not by searching, not by opening the file in a different program. That distinction sounds pedantic until you realise that most of the “redacted” documents that leak online were covered, not removed. A 2025 review of 72 published “redacted” PDFs found that roughly one in six still leaked recoverable text — and among US federal documents, closer to one in three. The tool worked exactly as designed. The person using it just reached for the wrong feature.
Why a black box does not work
Here is the thing almost no one is told: a PDF stores what you see and what the text says as two separate things. There is a visual layer — the pixels drawn on the page — and beneath it a text layer, the actual characters that make the document searchable and selectable. When you grab the rectangle tool in a basic editor and draw a black box over someone’s name, you add one more instruction to the visual layer: “paint a black rectangle here.” You have changed what the page looks like. You have not touched the text layer at all. The name is still sitting underneath, fully intact.
That is why the exploit is so trivial. Open the “redacted” file, press Ctrl+A (or Cmd+A on a Mac) to select everything, copy it, and paste into a plain text editor or Word. The black boxes vanish in the paste, and the words they were “hiding” come along for the ride. No special software, no forensics — just copy and paste. The same is true if you “redact” by changing the text colour to black, or by placing a black highlight over it: the characters are still there, and a search or a copy walks right past your black box.
The only methods that truly remove text
To redact properly, the sensitive content has to leave the file. There are two reliable ways to make that happen, and a handful of methods that only look like they work.
| Method | Does it actually remove the text? |
|---|---|
| Draw a black box / rectangle over it | No — text stays underneath, copies out |
| Black highlighter, or set text colour to black | No — still selectable and searchable |
| Delete the text, then cover the gap | Risky — deleted text can linger in the file’s history |
| Flatten the redacted page to an image | Yes — the text layer is discarded entirely |
| A true “Redact & apply” tool (e.g. Acrobat Pro) | Yes — when you apply, not just mark |
The pattern is clear: covering something up never removes it. You either need a dedicated redaction tool that scrubs the underlying content when you apply it, or you need to convert the affected page into a flat picture, so there simply is no text layer left to leak.
How to redact a PDF properly, for free
Ream’s Redact PDF tool takes the flatten approach, which is the most foolproof for everyday use. You mark the areas to hide, and on export every page that contains a redaction is rasterised — rendered down to a plain image with the black bars burned in. The characters, form fields and hidden data beneath those bars are not covered; they are gone, because that page is now a picture. Pages you did not touch are left as normal, selectable text.
Step by step:
- Open your file in Redact PDF. It loads in your browser — the document is not uploaded anywhere.
- Draw a black box over every piece of sensitive content: names, account and card numbers, addresses, signatures, dates of birth. Be generous with the edges.
- Check every page. Sensitive data has a habit of reappearing in headers, footers, a summary table or an appendix. Redact all of it.
- Export. Each redacted page is flattened on the way out, so the black bars are now part of the image, not a layer on top of live text.
Verify before you share — three quick checks
Professionals treat redaction as two jobs: applying it, and verifying it. Never skip the second. Before a redacted file leaves your hands, run these three checks on the exported copy:
- The copy-paste test. Open the finished PDF, select all, copy, and paste into a text editor. If any redacted word shows up, the redaction failed. With a properly flattened page, you will get nothing selectable where the black bars are.
- The search test. Use Find (Ctrl+F) to search for a name or number you redacted. It should return no results on the redacted pages.
- The metadata check. A document’s hidden properties — author, title, keywords, timestamps — can quietly undo careful page work. Strip them with Remove Metadata before publishing anything sensitive.
Golden rule: if you can still select it, copy it, or find it, it is not redacted. Redaction you cannot verify is not redaction.
When you need more than a black bar
For most people — hiding a home address on a lease before emailing it, blanking an account number on a statement, removing a name from a screenshot — flattening the page is exactly right, and free. But some situations call for a heavier process. If you are producing documents for litigation or eDiscovery, you may need software that keeps a defensible audit trail, supports exemption codes (“Redacted — Privacy”), and lets a reviewer sign off. Regulated disclosures may require specific tooling. In those cases a dedicated legal redaction platform or Adobe Acrobat Pro’s Redact tool (used with Sanitize to clear hidden data) is the safer route. The principle never changes, though: mark, apply so the data is truly removed, then verify.
Is redacting on Ream private?
Yes. Redact PDF runs entirely in your browser. The file you are trying to protect — often the most sensitive document you will handle all week — never leaves your device, is never uploaded to a server, and is not stored anywhere. The flattening happens locally, on your own machine, and the redacted copy is yours alone. For a privacy-first task, that is exactly how it should work.
Frequently asked questions
Can redacted text really be recovered from a PDF? If the “redaction” was just a black box, a highlight, or black-coloured text — yes, trivially, by selecting and copying. If the page was flattened to an image or the text was removed with a true redaction tool, there is nothing left to recover.
Does a black highlighter count as redaction? No. A highlight is a visual mark on top of the text; the characters remain fully selectable and searchable underneath it.
Why does my redacted page look slightly different after export? Because it was flattened to an image so the hidden text could be removed. That is the point — a flat image has no text layer to leak. Only the pages you redacted are affected.
Do I also need to remove metadata? For anything you publish, yes. Names and timestamps hidden in the file’s properties can reveal information you thought you had removed. Run Remove Metadata as a final step.
How do I redact a PDF for free? Open Redact PDF, draw black boxes over anything sensitive, and download — the redacted pages are flattened to images so the content underneath is permanently removed. Free, no sign-up.
Can I redact a PDF on my phone? Yes — it runs in your mobile browser, and because the flattening happens on your device, nothing is uploaded.
Is redaction reversible? No — that’s the point. Once a redacted page is flattened and downloaded, the text beneath is gone for good, so keep your original if you still need the full version.
Is it free? Yes — Redact PDF is free, needs no sign-up, and adds no watermark of its own.
Redaction is one of the few PDF tasks where “close enough” can cause real harm. Reach for a method that removes the text rather than hiding it, check your work with a copy-paste test, and clear the metadata before you hit send. Do that, and the black bars on your document will mean exactly what everyone assumes they mean: gone for good.
