Why Hiding Text in a PDF Usually Doesn't Remove It

This one has embarrassed governments, law firms, and large companies more than once. Someone takes a document, draws black rectangles over the sensitive names and numbers, saves it, and publishes it. It looks perfectly redacted. Then a reader selects the page, pastes it into a text editor, and every hidden word is right there.

It's an easy mistake to make, because the tools that cause it behave exactly as if they worked.

Why a black box hides nothing

A PDF page isn't a picture - it's a list of drawing instructions. Place this text run at these coordinates in this font. Draw this line. Fill this rectangle with this colour. A viewer executes those instructions in order, and later instructions paint over earlier ones.

When you draw a black rectangle over a name, you append one more instruction to the end of that list. The instruction that draws the name is still there, untouched, earlier in the sequence. Visually the rectangle covers it. In the file, both exist independently - and every tool that reads text rather than rendering pixels will happily report the name: copy and paste, text extraction, search indexing, a screen reader, or any PDF library.

The same applies to a white rectangle, a highlighter annotation set to opaque black, a sticker or shape pasted in an image editor that supports PDF layers, or cropping a page. Cropping is worth calling out specifically: it changes the visible page boundary, it does not delete the content outside it. Widen the crop again and the material reappears.

What actually removes information

Genuine redaction means editing the page's content so the sensitive instructions no longer exist, then saving a file that has no history of them. In practice there are three reliable routes.

A real redaction feature. Software with a proper redaction tool - Adobe Acrobat's Redact, macOS Preview's redaction, and several dedicated tools - marks regions and then runs an "apply" step that rewrites the page, deleting the underlying text and images. The crucial part is applying the redaction, not just marking it. Marking without applying leaves you exactly where you started.

Flattening to an image. Exporting each page as an image and rebuilding a PDF from those images destroys the text layer entirely - there is no text left to extract, because the page genuinely became a photograph with the black boxes baked in. This is crude and it costs you searchability, selectable text, and accessibility on the pages it touches, and it inflates the file considerably. But as a way to guarantee nothing is recoverable underneath a visual mark, it works. HerePDF's Redact tool does exactly this in one step - draw boxes or mark a whole page, and only those pages are flattened, so the rest of the document keeps its real text layer. You can also do it by hand with PDF to image followed by image to PDF, drawing your boxes first in something that renders them into the image.

Removing the page entirely. If the sensitive material is confined to certain pages, the cleanest answer is not to redact at all - extract only the pages you want to share. Splitting a document writes a new file containing just the ranges you chose; the pages you left out are not hidden in it, they were never copied into it.

The parts people forget

Even a correctly redacted page can leak through other channels in the same file:

• Metadata. Author name, the software used, and file paths often survive redaction untouched.
• Attachments and embedded files. A PDF can carry an entire spreadsheet inside it.
• Annotations and comments. Review notes may hold the very text you removed from the page.
• Bookmarks and the document outline. Section titles can name what you redacted.
• Form field values. A flattened-looking form may still store its filled-in data.
• Thumbnails and previews. Some files cache small page images generated before the edit.

How to check your work

Never trust that it looks right. Before sending a redacted document, do all three of these:

1. Open the finished file, press Ctrl+A (Cmd+A) to select the whole page, copy, and paste into a plain text editor. Read what comes out. If a redacted name appears, the redaction failed.
2. Use Ctrl+F to search the document for a term you removed. A hit means it's still in there.
3. Check the document properties for author and title metadata, and look for an attachments panel.

Do this on the actual file you are about to send, not on the version still open in your editor - the editor may be showing you its in-memory state rather than what was written to disk.

Why HerePDF's Redact tool flattens instead of drawing

For a long time this guide's answer to "does HerePDF have a redaction tool" was a deliberate no - a tool that draws boxes is trivial to write and would have fit neatly alongside the others, and it would have been actively dangerous, because it would look like it had done the job. Redaction that only appears to work is worse than no redaction at all: it converts a task you know is risky into one you believe is finished.

Redact exists now because it avoids that trap structurally rather than promising to avoid it. It never draws a box on top of anything - it renders the page you marked, paints black directly onto that rendered image, and rebuilds the page from the result. There is no separate "delete the text" step to trust, because the text was never in the output to begin with. Run the copy-paste test from above on the result, and there is nothing to find on a redacted page.

It covers some of "The parts people forget" above, not all of it. Form fields on a marked page are removed along with their values. The text under your boxes is also looked for in bookmark titles, in comments on every page and in link addresses, and replaced or removed where it appears. The tool tells you how many it changed. Metadata and attachments are untouched, and so is the body text of pages you didn't mark. For those, use the metadata tool alongside it, or remove whole pages with split when the sensitive material is confined to pages you can simply leave out.