Security · 5 min
How to redact a PDF safely
Why "black rectangle on top" isn't always enough — and how to make redactions really stick.
The trap
A black rectangle drawn on a page hides the text visually but the underlying glyphs may still live in the PDF's content stream. Copy-paste, or a forensic tool, can recover them.
When a rectangle is enough
- The redacted region is an image (e.g. a scan).
- The PDF will only ever be viewed on screen by trusted reviewers.
- You re-flatten the file afterwards.
Belt-and-braces flow
- Use the Redact PDF tool to cover the sensitive regions.
- Run the output through a flattening pass — open it in PDF Info and re-save, or use
qpdf --object-streams=generate redacted.pdf flat.pdf. - Spot-check by selecting text underneath the redaction area.
Best practice
Treat any redacted document as if it might be re-opened by a motivated attacker. If the stakes are high (legal discovery, GDPR data subject requests), use a tool that removes the underlying objects, not just covers them.