Redaction versus covering: why a black box is not enough

Redaction failures are among the most reliably embarrassing document mistakes, and they keep happening because the wrong action looks exactly like the right one.

The failure mode

Someone opens a PDF, draws a filled black rectangle over a name, saves, and sends.

On screen the name is gone. In the file, nothing about the text has changed. The rectangle is simply another drawing instruction, added after the text and painted on top. Every character is still in the content stream at its original coordinates.

Recovering it takes no skill: select the area and copy, or extract the text. The reader gets the black box and the words.

Why this specific mistake is so common

Because the visual feedback is completely convincing. The tool did what you asked — draw a rectangle — and the result looks identical to a proper redaction. Nothing warns you, and checking requires knowing to check.

Compounding it, "redact" in many pieces of software means "annotate with a redaction mark", with removal happening only on a separate apply-and-save step. Skip that step and you have shipped a marked-up document.

What real redaction requires

Three things, in order:

1. Remove the underlying content objects — the text runs, image regions or vector paths in the covered area — not merely paint over them.
2. Rewrite the file, so that no incremental revision history retains the earlier state.
3. Strip metadata that might reference the removed material — a title, a keyword, an annotation.

The reliable manual route

If you do not have a tool that removes objects, there is a route that works because it destroys the text layer entirely.

1. Cover the sensitive regions with Redact PDF.
2. Rasterise every page with PDF to JPG at 200–300 DPI. This converts each page into pixels. The black rectangles become part of the image, and the text underneath ceases to exist as text — it was never rendered.
3. Reassemble with JPG to PDF.
4. Verify with PDF to Text: the output should be empty.

This is a blunt instrument with real costs. The whole document loses selectable text and becomes larger, and if it needs to remain searchable you would have to OCR it afterwards — which recognises only what is visible, so redacted content stays gone. But it is verifiable, which most redaction workflows are not.

When a rectangle is genuinely sufficient

If the page is already a scanned image, there is no text layer to leak. A rectangle burned into the raster removes those pixels permanently. The requirement is that the rectangle is composited into the image rather than stored as a separate overlay object — flattening or rasterising guarantees that.

This is why redacting scanned documents is technically simpler than redacting born-digital ones, and why the born-digital case is where the leaks happen.

Verify, every time

Redaction is one of the few document operations where the failure is invisible and the consequence is serious. Build the check into the routine:

• Extract text from the finished file and search for the removed words.
• Try to select across the redacted region in a viewer.
• Confirm the page count and file size changed in the way you expect — a "redacted" file byte-identical in structure to the original is a warning sign.

What redaction does not cover

Removing a name from page four does not help if the same name is in the document metadata, in a comment, in an embedded attachment, or in the filename. Read what is hidden inside a PDF and work through the pre-send checklist.

And if the stakes are legal — discovery, a data subject request, a regulatory filing — use software built for defensible redaction with an audit trail. A browser tool is the right choice for ordinary confidentiality, not for a process that may have to be proved in front of someone.