5 PDF Redaction Mistakes That Leak Data (and How to Avoid Them)

Redaction failures make the news more often than they should: a court filing, a government report or a corporate PDF goes out with "redacted" text that anyone can recover in seconds. The mistakes are almost always the same handful. Here are the five most common — and how to redact a PDF properly and privately.

Mistake 1: Drawing a black box over the text

This is the classic. People place a black rectangle (or a black highlight) on top of sensitive text and save the file. The problem: the text is still there, sitting underneath the box. Anyone can select it, copy it, or pull it out with PDF to text. The box is decoration, not deletion.

Fix: use real redaction that removes the underlying text and image content inside the marked area, then draws the bar. The Redact PDF tool does exactly this.

Mistake 2: Changing the text color to "hide" it

Setting text to white, or highlighting it the same color as the background, hides it visually but leaves it fully in the file — searchable and copyable. Same flaw as the black box.

Fix: the content has to be removed from the document, not merely made invisible.

Mistake 3: Forgetting the hidden metadata

Even with the visible text properly redacted, a PDF carries metadata: author name, creation software, timestamps, sometimes revision traces. A document about an anonymous source can still name the person who created the file. Redaction doesn't touch this.

Fix: after redacting, remove the metadata before you share.

Mistake 4: Uploading the document to redact it

To redact a sensitive file, many tools make you upload the un-redacted original to their server. That's the worst moment to expose it — the full, still-sensitive document leaves your control before a single word is removed.

Fix: redact in your browser so the file never leaves your device. You can confirm there are no uploads in DevTools → Network.

Mistake 5: Trusting redaction you can't verify

"We redacted it" is not the same as "the data is gone." If you can't check, you don't know.

Fix: after redacting, test it: try to select the area, copy from it, or run the file through PDF to text. If nothing comes out, the redaction held. With true redaction, there's nothing left to recover.

How to redact a PDF properly

1. Open the Redact PDF tool — it runs in your browser.
2. Mark the areas to remove. You can also auto-detect emails, phone numbers and ID numbers.
3. Apply the redaction; the underlying content is deleted, not covered.
4. Strip the metadata.
5. Verify by trying to copy or extract the redacted text — nothing should come out.

The bottom line

Most redaction leaks come from covering instead of removing, ignoring metadata, or uploading the original. Use true, in-browser redaction, clean the metadata, and verify the result. Redact your PDF properly.