How to Redact Sensitive Information in a PDF

PDF redaction failures have caused real damage. In 2011, a law firm accidentally filed an unredacted document in a public court case — the "redacted" text was covered with a black box, but the text remained in the PDF data and was trivially extractable. In 2019, the NSA released a redacted report where the blacked-out sections could be highlighted, copied, and read in plaintext.

These failures share a common cause: the redaction was visual, not structural. A black box is not a redaction. This guide explains the difference, shows how to redact correctly, and explains how to verify that your redaction actually removed the underlying content.

The Black Box Problem

A PDF page can contain multiple layers of content stacked on top of each other. When you draw a black rectangle over text using a basic annotation tool, you have:

1. The original text still in the PDF as searchable, selectable, copyable data
2. A black rectangle annotation on top of it

The text is visually hidden but structurally present. Anyone who:

• Selects all and copies text
• Runs a text search
• Removes or hides annotations
• Processes the file with any PDF text extractor

...will see the "redacted" content.

This is not redaction. This is concealment. It fails.

True redaction must remove the underlying content from the PDF's data structure, not just obscure it visually.

How Proper Redaction Works

Proper redaction involves three steps:

1. Mark the content for redaction: Identify the text or region to remove
2. Burn in the redaction: Replace the marked content with opaque marks (typically black) and permanently delete the underlying data from the PDF structure
3. Sanitize: Remove metadata, hidden text layers, and any other non-visible data that might contain the redacted information

Step 2 is the critical one. After burning in the redaction, the PDF's page content stream where the text appeared should be overwritten, not just covered.

How to Redact a PDF with LuraPDF

LuraPDF's Redact PDF tool performs structural redaction — it removes the underlying content, not just covers it.

Step 1: Upload and identify content

Open the LuraPDF Redact PDF tool and upload your document. Browse to the pages containing sensitive content.

Step 2: Mark redaction areas

Draw rectangles over the content you need to redact. You can:

• Drag to select text regions
• Draw boxes over images or graphic elements
• Mark multiple areas on the same page before applying

Step 3: Apply redaction

Click "Apply Redactions." This triggers the burn-in process: the content under each marked region is permanently removed from the PDF data, and a solid black fill is rendered in its place.

Step 4: Verify

After downloading, open the redacted PDF and attempt to:

• Select and copy text in the redacted areas (should return nothing)
• Search for words you redacted (should find nothing)

This verification step is essential before sharing any document with legal, medical, or sensitive content.

What LuraPDF Redacts

• Text: Extracted from the PDF's content stream and removed
• Images: Image data in the marked region is cropped out
• Annotations: Any annotations (comments, highlights) in the redacted area are removed

What to Also Remove: Metadata

After redacting the visible content, don't forget metadata. PDFs often contain:

• Author name
• Organization name
• Creating application
• Revision history and edit dates
• Comments and annotations in other sections

Use LuraPDF Remove Metadata after redacting to strip this information. This is particularly important when the metadata itself is sensitive (e.g., the author name reveals the identity of a confidential source).

High-Stakes Redaction Scenarios

For legal, medical, or national security documents, consider additional steps:

Court filings: Many courts require specific redaction formats. Verify with the court's document management guidelines. Some require the redaction color to be black specifically (not grey or white).

Medical records: HIPAA-covered documents require that all 18 types of identifying information be removed. This includes dates, geographic data below state level, phone numbers, email addresses, URLs, social security numbers, and medical record numbers.

Government documents (FOIA): Freedom of Information Act redactions in the US must meet specific legal standards. Redacting too much (over-redaction) can be as problematic as redacting too little.

Attorney-client privileged documents: Work product privilege redactions should be reviewed by a lawyer before filing.

Verifying Your Redaction

After redacting and before sending:

1. Open the redacted PDF in a plain text viewer or PDF reader
2. Use "Select All" + "Copy" and paste into a text editor — verify no redacted text appears
3. Search for specific words you intended to redact
4. Open the file's properties and verify metadata has been cleaned
5. If possible, have a colleague attempt to access the redacted content

For maximum assurance, consider printing the redacted PDF to a new PDF (using your operating system's print-to-PDF function). This "flattens" the entire document to pure visual content, eliminating any residual data structures from the original.

Frequently Asked Questions

I used highlighting to cover text — is that a real redaction? No. A highlight annotation is cosmetically identical to a black box — the text remains in the PDF data. Only structural redaction (which deletes the underlying content) is a real redaction.

Can I redact scanned PDFs? Yes, but differently. Scanned PDFs are images. Drawing over an image region effectively removes those pixels permanently — there is no underlying text data to worry about. LuraPDF's redaction tool handles this correctly for image-based PDFs.

Does redaction work on password-protected PDFs? Remove the password first with Unlock PDF, then redact.

Can I un-redact a document after applying? No. Redaction is permanent and irreversible by design. Keep a copy of the unredacted original in secure storage before redacting.

Are white redactions (white boxes) the same as black ones? Structurally, yes — if the content is removed from the PDF data, the color of the replacement fill is cosmetic. However, convention and many regulatory requirements specify black. White boxes look like they contain missing content rather than redacted content, which may cause confusion.

The difference between a properly redacted document and a "covered" document is invisible to the eye — but completely visible to anyone who looks past the visual layer. When the stakes are high, verify. When in doubt, use proper structural redaction, not boxes.