Skip to content
dialegein

PDF redaction guide

It is the most dangerous misunderstanding in this entire category. A black rectangle drawn over a name looks like redaction, prints like redaction, and is not redaction - the original characters are still in the file. How long recovery takes depends on the tool and the document, and the point is that it is possible at all.

One library's own maintainers put the underlying problem better than we can. pikepdf's documentation states that it "cannot reliably redact text or images from a PDF, and neither can any purely programmatic tool that operates on the file's structure." Read it as the maintainers describing their own boundary rather than as a finding against programmatic redaction in general: tools that work on a file's structure can and do remove content, and what the sentence is about is what that kind of tool can promise on its own, without a person or an image step in the loop. The entries below each say what their own evidence is.

Covering

Invoice for ████████ Ltd

The box hides the text on screen and on paper. Select the line, copy it, and the hidden words come with it. Search the document for them and they are found.

Removing

Invoice for ████████ Ltd

Identical on screen. The difference is that the characters are gone from the file - not hidden, deleted. Copying and searching find nothing, because there is nothing left to find.

And a third option, worse than either

Pixelating or blurring the text and calling it redacted. Security researchers have shown that pixelated text can be recovered algorithmically - by generating candidate characters, blurring them the same way, and comparing the result against the original. A blurred name is obscured, not hidden.

If a tool only offers blur, mosaic or pixelate, it does not redact. See the Unredacter research for how it works.

Check it yourself

Whatever tool you used, do this before you send the file to anyone:

  1. 1. Try to select the text underneath the black box with your cursor.
  2. 2. Select the whole document, copy it, and paste it into a plain text editor. Search for the words you meant to remove.
  3. 3. Use the document's own search for one of those words.

If any of those finds it, the content is still there and the file is not safe to share. This test is worth doing even if the tool advertises redaction, and even if the tool is one we list below as removing content - for 32 of those entries our classification comes from what the vendor documents, not from a test we ran ourselves. Test your own document, with your own tool, at the settings you will actually use.

What it cannot do is clear the file. A copy-and-search check finds text that was left behind; finding nothing means the text layer is clean, not that the document is. Images the box covered, metadata, attachments, revision history, hidden objects and text drawn with a font that does not map to characters are all invisible to this test, and a tool can pass it while leaving every one of them intact. On a document where that matters, the only real check is on the exported file, and a redaction you have not verified is a redaction you are trusting.

One distinction that gets blurred: removing an image you have selected and recognising an image with OCR are different operations. If you can see the region and it should go, a tool can remove it without OCR being involved at all. OCR matters when you need to find the content without a person pointing at it, or when the sensitive material is inside an image in the first place.

Which tools actually remove content

Based on each vendor's own documentation, with 8 exceptions: the entries marked below were tested on a canary document rather than read off a product page. Where a vendor's wording is ambiguous, or we could not determine it, the tool is listed as unverified rather than guessed at.

Claims to remove the content (38)

Three mechanism caveats, and they are not the same trade. pdf-redactor strips the text layer properly, but its own documentation says images, embedded files, forms and signatures are not examined - so a redacted scan may still show everything. PDF Studio's redaction removes page content only; form fields and annotations need a separate procedure. And the 6 entries on this list we tested ourselves are worth comparing with each other, because "removes the content" hides two very different costs. SnackPDF removes it by rebuilding each affected page as an image: the marked content is genuinely gone (a canary string under the box is absent from the saved file and present in the original), but so is everything else on that page - one box costs the whole page its selectable text, links and vector structure. Stirling PDF and MuPDF.js take the other route: they delete the marked text from the page structure and paint a solid fill where it was, so the page is not flattened, lines outside the box keep their text, fonts and selectability, and the saved file contains no image at all. All three are real redaction. Which one you want depends on whether losing the rest of the page matters to you.

Check your tier, not just your tool

Redaction is frequently held back for a more expensive plan, so being on the list above does not mean the version you have can do it:

  • Power PDF - Advanced only. The £95 Standard edition does not include it; you need the £131 Advanced.
  • Bluebeam Revu - Complete and Max only, not Basics or Core.
  • Foxit PDF Editor - manual redaction is in both tiers, but AI Smart Redact is Editor+ only.
  • PDF Architect - Pro and Business. Not a separate Secure module, and not in the free plan.
  • PDFescape - the Ultimate desktop tier, not the free browser editor.
  • PDFsam - Pro or Pro+OCR only. Not in the free open-source PDFsam Basic, and not in Enhanced Standard.
  • PDF Expert - Pro. A one-time in-app purchase on iOS; the free Mac download is only a trial.
  • PDF-XChange Editor - a paid licence. The vendor's own comparison chart marks redaction as unavailable in the free version.
  • SwiftScan - SwiftScan Plus.
  • Adobe Acrobat - the desktop Acrobat Pro tool only. Acrobat on the web has no Redact tool at all, so the browser version our listing links to cannot do it.
  • Nitro PDF Pro - the Windows guide states permanent removal explicitly; the separate Mac guide says only that you can block out or erase text.
  • MuPDF - there is no mutool redact. Redaction lives in the C library, the MuPDF.js API and the mupdf-gl viewer, so a shell script cannot do it.
  • iLovePDF - split by surface, and the web tool's page contradicts its own file. It promises to “Permanently remove visible text and graphics” and to “black out” PDF text, and the canary we ran through it came back with the redacted string still present. The Desktop app advertises permanent removal separately and was not tested. Treat the web tool as covering.
  • PDFix - split by product, and harder to spot than the rest. Redaction is an SDK Professional-tier feature and is not in the PDFix Desktop application at all: the word appears nowhere on the Desktop product page, pricing, changelog or any of the 45 Desktop user-guide pages, and the SDK's own price table ticks it only at Professional and Enterprise.
  • Aspose.PDF - licensed copies only. In evaluation mode the library processes just the first four pages of a document, so a redaction run on anything longer leaves the rest untouched and reports no error. It is also a two-step API, and stopping after the first step is this page's whole subject: the vendor's documentation describes adding a RedactionAnnotation as covering the text, and a separate redact() call as what “permanently applies” it. Code that adds the annotation and saves has drawn a box over content that is still in the file.
  • iText pdfSweep - a separately licensed add-on, and it cannot see text baked into a scan. The vendor's own guidance is to combine it with their OCR add-on. Its verdict here rests on the product page's own description of the mechanism rather than on API documentation - the weakest basis on this list, and recorded as such.

Two further limits apply across most of this list rather than to any one tool. Redaction removes what you can see; it rarely removes what you cannot. Metadata, attachments, embedded files, form fields and document-level JavaScript usually survive a page-level redaction, and several vendors ship a separate sanitiser for them - Aspose's is explicit about it, iText documents nothing equivalent. And very few of these tools read text inside an image, so a scanned document usually needs OCR before redaction means anything.

Covers the content instead (4)

These tools present a redaction or whiteout feature that draws over the text. The content remains in the file. That may be fine for hiding something in a printout and is not fine for anything else.

One vendor deserves credit here for saying so itself. Sejda ships a whiteout tool, and the tooltip on that tool reads “Whiteout hides but will not completely remove underlying text or images. Not suitable for redacting sensitive data”. That is the honest version of a covering tool, and it is rarer than it should be.

  • DocHub Free · paid from £5.93 a month
  • iLovePDF tested by us Free · paid from £5.00 a month
  • PDF Candy tested by us Free · paid from £4.00 a month
  • Sejda Free · paid from £5.00 one-off

Not determined (12)

Redaction exists in many of these but we have not yet confirmed whether it removes content or covers it. Treat any of them as covering until you have run the check above.

If you need this to be safe

  • - Redact, then flatten. Exporting to an image-based PDF destroys the text layer entirely, though it also destroys searchability and increases file size.
  • - Run the check every time. A classification on a web page, including this one, is not the same as testing the file you are about to send.
  • - Remember the metadata. Author, title, edit history and embedded thumbnails can survive even when the visible text is gone. Some tools clear these; many do not.
  • - Consider not having the file at all. If a document is genuinely sensitive, the safest redaction is the one where the sensitive version never existed in a shared location.

Classifications here come from each vendor's own published documentation and are recorded per tool. We have not tested every tool's output, and we say so on the records that are unverified rather than presenting a guess as a verdict. If a vendor believes we have this wrong, the corrections route is open to them.

Related guides