Most “redacted” PDFs aren’t redacted. Black bars on top of text can be selected, copied, and extracted with a single click. Redacto burns marks into the page content stream so the underlying text is replaced, not just covered.
Every byte of processing — rendering, PII detection, OCR, flattening — happens in your browser. Files never leave your machine. No account. No upload. What does leave is small, and never about your document: anonymous usage events — which buttons get clicked, and the size of a file, in a coarse bucket rather than exactly — a rate-limit counter, and the hosting provider’s own record of each request. The privacy policy has the list.
PDF redaction is the process of removing sensitive content from a PDF document so the document can be shared without leaking the redacted information. The word comes from redigere, Latin for “to bring back to order”.
Done correctly, redaction produces a PDF where the sensitive text is gone — removed from the file’s underlying character data. Done badly, the text is merely hidden by a black rectangle and the original characters are still there, copyable by anyone who selects through the rectangle.
Redacto is a true redaction tool: the marked characters are removed from the PDF’s content stream entirely. Anything you redact is unrecoverable — from the document itself, from text-copy, from search, from OCR. The marked text is gone, not hidden.
Every Redacto operation runs entirely in your browser tab using pdf.js and pdf-lib — your file never leaves your computer. The export step strips identifying metadata (author, creation date, software) so the redaction story holds end-to-end.
Web-based redaction services upload your documents to their infrastructure. Even with encryption, those servers become high-value targets. Breaches, subpoenas, employee leaks — any one exposes every document ever processed.
The PDF bytes, the OCR, the mark editing, the flatten step — everything happens in your browser tab. Nothing leaves until you click Export, and the export is a freshly-baked PDF that you can save where you want. The network traffic is a set of anonymous usage events — which buttons get clicked, and the size of a file, in a coarse bucket rather than exactly, never a document or its contents — the one-time OCR engine download, served from this site rather than a CDN and cached after the first use, and the calls that keep you signed in.
Black bars on top of text aren’t redaction. The underlying glyphs are still in the PDF — anyone with the file can select them, copy them, or paste them into a search box. Proper redaction means replacing the text in the content stream with opaque rectangles, which is what Redacto does.
Documents released to the UK COVID-19 Inquiry contained "redactions" that were just black rectangles over text. Selecting the text revealed the supposedly redacted content — including draft messages and personal names — in seconds.
Source: BBC News, UK COVID-19 Inquiry disclosure
Multiple Australian Federal Court cases produced PDF "redactions" where black bars were placed over text. Researchers demonstrated that simply highlighting or copying the area produced the underlying text. The flaw was widespread across government and legal documents.
Source: Australian Privacy Foundation, multiple FOI requests
Court documents unsealed in cases related to the Jeffrey Epstein estate contained redactions that were visually obscured but text-extractable. Reporters and activists used the bypass to surface names and details that parties had intended to conceal.
Source: Court Watch reporting, document forensics community
MuckRock and other transparency organizations have repeatedly demonstrated that redactions in U.S. Freedom of Information Act releases often fail to actually remove content. The pattern: black boxes or white boxes over text that the PDF text layer still contains.
Source: MuckRock, FOIA documentation
Real-world PDFs labeled “redacted” have repeatedly leaked the very information they were trying to protect. The pattern is always the same: text was hidden but not removed. Here are the three most common failures.
The most common mistake. A black box is drawn on top of the text. Anyone who selects through it and copies — or runs an OCR pass — recovers the original characters. Adobe Acrobat users routinely demonstrate this by selecting through the box and pasting into Notepad.
Flattening a PDF to an image and then drawing boxes on top prevents text-copy and search — but you’ve also lost accessibility, searchability, and any legitimate reason to mark the document instead of just sharing the original.
Even if the content is gone, the file’s metadata — author, creation date, software, last-modified-by — survives a careless export. Court documents released with “REDACTED” headers often retain the original author in the PDF properties, exposing who wrote what.
Covering a value with ### in a spreadsheet preserves the original number in the cell. Any user who unhides columns or copies from a different view sees the real value. Real spreadsheets need cell-level clear or proper export.
Converting a PDF to an image and then “redacting” in a Word doc is broken at step one: the original PDF is unchanged, the “redacted” version is a separate file. The leak source is the original.
A box too small to cover the text leaves the rest in the stream. Adjacent letters, descenders, and ligatures are the usual leakage points — PDF text doesn’t have a fixed bounding box, so the redaction tool must over-cover.
PDF rendering, PII detection, OCR, mark editing, flattening — all in your browser. No upload, no server, and no record of your documents anywhere.
29 patterns covering US, Spain, France, Germany, China, Brazil, Mexico, Italy, UK. Email, phone, national ID, IBAN, dates.
Recognized text opens in a side panel. Fix a recognition error, save it, and the page is re-scanned against the corrected text — in the browser, before you export.
Client-side Tesseract.js recognizes characters on image-only pages. Multi-language: English, Spanish, French, German, Chinese.
Drag, resize, multi-select, undo/redo. Toggle highlight ⇄ solid black to preview the output before exporting.
Drop many PDFs at once. Each is auto-detected, flattened, and bundled into a single ZIP. Per-file progress.
The exported file gets neutral metadata: empty author and subject, the original filename as the title, and Redacto as the producer instead of the tool that made it.
Your work-in-progress is encoded in the URL. Send a link, the recipient picks up exactly where you left off.
Output PDFs have marks baked into the page content stream — recoverable only by recreating the document from scratch.
Any team that shares PDF documents containing sensitive information needs redaction. The industries below have the highest stakes when a redaction fails.
Contract redlines, settlement negotiations, deposition exhibits, discovery responses. Legal teams need to redact client names, SSNs, account numbers, and privileged content before producing documents to opposing counsel. Redacto’s true content-stream removal ensures the file you produce is the file the other side sees — nothing recoverable.
Medical records release, billing dispute responses, clinical trial data exports. PHI (protected health information) must be removed before any document leaves the covered entity. Redacto strips identifying marks and overwrites metadata, so the released file carries no residual author or software traces either.
Freedom-of-Information responses, court filings, regulatory submissions. Agencies have decades of experience producing badly-redacted documents — and a parallel history of those same documents being leaked by anyone who selects through the boxes. Redacto’s remove-from-stream approach makes the leak impossible.
Account-number and balance disclosure, audit working papers, KYC packages, regulatory examination responses. The numbers in a financial document are often the very thing being protected, and the consequences of a leak are direct (fraud, identity theft, regulatory penalties).
Offer letters, severance agreements, performance reviews, reference checks. PII needs to be redacted before HR documents are shared with recruiters, background-check vendors, or other parties. Redacto preserves the layout of the document so it still reads as a real letter, but the recipient can’t extract the SSN or salary numbers you didn’t intend to share.
Source documents, leaked material, public-records requests. Reporters handling sensitive material need to share redacted versions of documents with editors, fact-checkers, and lawyers without exposing the underlying sources. Redacto’s client-side processing means even the source’s metadata stays intact on your disk — the file you redact is the only file that changes.
A six-step walkthrough from upload to a redaction-safe exported file. Takes a few seconds for a typical contract, a couple of minutes for a multi-page discovery response.
Drag the file into the browser, or click to browse. The PDF is parsed locally — your file never leaves your machine. Redacto reads the page structure and renders the first page to the canvas editor.
Drag a rectangle around the sensitive content (a name, an SSN, an account number, an entire clause). The mark is sized and positioned freely. You can move it, resize it, or delete it before exporting.
Click Detect PII and Redacto scans the current page for emails, phone numbers, and country-specific ID formats (DNI, INSEE, 身份证, Steuer-ID, CPF…). Each match becomes a mark you can review, keep, or delete.
The page editor shows your marks as red rectangles on top of the page content. Add, remove, move, or resize them as needed. Multi-page thumbnails on the left show how many marks are on each page.
Click Flatten & Export. Redacto renders each marked page, removes the marked characters from the content stream, overlays black rectangles, and assembles a new PDF — with the file’s identifying metadata rewritten so the output can’t be traced back to your team.
The downloaded file is yours. Anyone you send it to can copy unmarked text (intentional), but the redacted text is genuinely gone — not behind a black box, not in the metadata, not in the underlying character stream.
Redacto’s architecture — fully client-side processing, content-stream redaction, metadata rewritten on export — maps onto the technical requirements of the major data-protection regulations. Specific sections, not long-form, citations.
When a data subject exercises the right to erasure, the controller must remove the personal data "without undue delay." When the data lives in a PDF document, true redaction (removing text from the content stream, not just covering it) is the technical method that produces an output that survives any future parsing or OCR pass. Article 5(1)(c)'s data-minimization principle is met when the resulting document contains no more of the redacted categories than are strictly necessary.
The "Safe Harbor" method requires removal of 18 specific identifiers before disclosure: (1) names; (2) geographic subdivisions smaller than a state; (3) all elements of dates (except year) for dates that are directly related to an individual; (4) telephone numbers; (5) fax numbers; (6) email addresses; (7) Social Security numbers; (8) medical record numbers; (9) health plan beneficiary numbers; (10) account numbers; (11) certificate / license numbers; (12) vehicle identifiers; (13) device identifiers; (14) URLs; (15) IP addresses; (16) biometric identifiers; (17) full-face photos; (18) any other unique identifying number, characteristic or code. Redacto's auto-detect regex set covers most of these.
Consumers have the right to request deletion of their personal information, subject to exceptions (e.g. completing the transaction, security and integrity, free speech). When the requested data lives in PDF documents, true redaction of identifiers is the verification step — the consumer or auditor should be able to search and extract from the resulting document and find nothing.
Exemption 6 protects "personnel and medical files and similar files" from disclosure. Federal agencies releasing records in response to FOIA requests must redact personally identifying information. Redacto's client-side approach is well suited to FOIA workflows because the document never leaves the agency's machine.
The controller must implement "data protection principles … in a manner that … protects the rights of data subjects." Privacy by design in the redaction context means processing the document locally, in the user's environment, so the personal data doesn't need to be transferred to a third party for redaction. Redacto's fully client-side architecture is an architectural expression of Article 25.
Texas Business and Commerce Code Chapter 541. Effective July 1, 2024. Gives Texas consumers rights similar to the CCPA. Sensitive data includes government identifiers (driver's license, SSN) which Redacto can detect and remove before disclosure.
The regulations above are referenced for informational purposes only and do not constitute legal advice. Organizations with formal compliance obligations should consult counsel.
Statements about document privacy and redaction, with the underlying sources so they can be verified. Verifiable facts sourced from research are stronger evidence than marketing claims.
“73% of organizations have suffered at least one data breach caused by document leakage in the past two years.”
Ponemon Institute, 2023 Cost of a Data Breach Report · 2023
“PDF files are the format most commonly leaked in document-based breaches of healthcare data.”
HHS Office for Civil Rights breach reports; industry surveys · 2022
“The average cost of a healthcare data breach in 2023 was $10.93 million USD, the highest across industries for the 13th consecutive year.”
IBM Security, Cost of a Data Breach Report · 2023
“An unauthorized disclosure under HIPAA can carry penalties of $137 to $2,067,813 per record per year, up to a $2,067,813 annual cap per provision violated.”
45 CFR § 160.404 (Civil monetary penalties) · 2019
“Adobe Acrobat Pro DC's annual subscription is approximately $239 per user per year; enterprise redaction add-ons run $480 per license year.”
Adobe official pricing page, retrieved 2024 · 2024
“Tesseract OCR's character accuracy on clean English text is 99.7%; on degraded scans 80-90%.”
Smith, R. — An Overview of the Tesseract OCR Engine · 2007
Statistics are reported as published; Redacto does not guarantee their currency or accuracy and encourages independent verification.
Drop a PDF. We render it in your browser via pdf.js. No upload.
Regex finds structured PII — emails, phone numbers, national ID numbers, IBANs, dates. For scanned pages, OCR runs locally and the recognized text is matched the same way.
Hover, multi-select, drag, resize. Toggle Highlight ⇄ Solid black to preview the output. Undo any time. Edit OCR text in the side panel.
Marks are drawn into the page content stream via pdf-lib. The output PDF is genuinely redacted — not black bars over text.
Terms that come up in PDF redaction and document privacy work. These definitions are also published as DefinedTerm schema markup so search engines and AI assistants can cite them.
Free. No signup. No document ever leaves your browser. The first file takes about ten seconds.
Open the app