Is a "Black Box" Enough in a PDF? Behind the Scenes of Real Redaction

A black box doesn't actually delete anything

Drawing a black rectangle over a national ID number, an IBAN, or a customer name in a PDF to "hide" it is, as far as we've seen, one of the most widespread security misconceptions in the world. Visually, the text appears to disappear, but the way the PDF format actually works contradicts that: a PDF is really a document made up of layers stacked on top of one another. While the actual text objects, character codes, and font maps sit in the underlying layer, the black box drawn over them is just a new visual layer — like a sticker painted over the text.

The consequence of this has been seen over and over in practice: when someone opens that "hidden" PDF and selects and copies the text, or examines the file in a text editor or PDF parser, the original content underneath the box comes out intact. Sometimes something even simpler is enough — dragging the box away with the mouse, or deleting it. This is precisely the root cause behind a number of corporate breaches, leaked court documents, and journalism scandals: documents that were assumed to have been "redacted" but were in fact only visually masked.

How the PDF Redaction tool solves this problem

The PDF Redaction tool on our platform works with an approach that fundamentally rejects this visual-box fallacy: rasterize-flatten. In essence, the method follows these steps:

1. The user marks the area to be hidden on the page (text, signature, table cell, image region — whatever it may be).
2. The marked page is taken out of its vector/text-based structure and converted into a pixel-based image (rasterized). At this point, all text objects, font references, and character data on the page cease to exist — all that remains is an "image."
3. The marked region is permanently filled in (flattened) on this image, and the page is repackaged into a PDF.

The result: no "hidden" text object remains on that page that can be selected, copied, or extracted with a parser. Because there's no such thing as a text object left anymore — the page has become an image entirely. This isn't cosmetic hiding; it means the data has been physically removed from the file structure.

Why we rasterize the whole page, not "just that area"

Some tools only try to "delete" the text underneath the marked box, but this is an extremely fragile operation given the PDF's nested object structure — there's a high risk of leaving remnants in overlapping text flows, hidden layers (OCG), form fields, or metadata. Converting the entire page into an image and applying a permanent fill on top is the technically most definitive way to eliminate this risk. There is a cost, of course: the page can no longer be selected as text and stops being searchable. But that's precisely the point of redaction — an irreversible form of hiding. Our tool makes this trade-off clear to the user; we don't leave the difference between "hidden" and "deleted" ambiguous.

When is this needed

Redaction is one of the PDF tools most often misused for purely "cosmetic" purposes. The real need usually arises in scenarios like these:

• Freedom-of-information requests / sharing public documents: An institution must hide third parties' identity information, signatures, or figures that constitute trade secrets before sharing a document.
• Sharing legal documents: When a contract or case file is shared with the opposing party or the public, a client's financial details or personal data must be removed.
• HR and resume pools: When sharing candidate data for analysis, fields like national ID number or date of birth may need to be permanently removed.
• Healthcare and insurance documents: Patient identity information and policy numbers must actually be removed from the document before sharing — not just visually.
• Press and researcher use: In documents requiring source protection, identifying details like names, phone numbers, or emails must be confirmed as completely deleted from the file.

What these scenarios have in common is this: the document is shared under the assumption that the hidden information can never be recovered in any way. A visual box doesn't meet that assumption; rasterize-flatten does.

What this means for privacy and security

The reliability of a redaction tool can really be boiled down to a single question: "Could someone examining this document at the raw data level reach the hidden information?" With methods that only use a visual box, the answer is often yes — the text layer, metadata remnants, or "undo" layers may still be sitting there. With the rasterize-flatten approach, since the page is now nothing but an image, the technical answer to that question can be no.

Alongside this, the processing itself matters too: on our platform, files aren't kept permanently on the server — they're automatically deleted a short time after processing. So it's also part of the architecture that the data "hidden" during redaction leaves no trace anywhere else once processing is complete. A redaction tool's privacy promise should be measured not only by the output file but also by how that file is processed — we treat these two together.

One final note: rasterize-flatten is a powerful method, but it isn't a magic wand. Not sharing a previous, unredacted version of the same document, not leaving sensitive information in file names or metadata, and correctly marking the areas to be hidden all remain the user's responsibility. The tool guarantees that correctly marked content is deleted irrecoverably; deciding which content needs to be hidden is up to the user.