How to Redact Sensitive Information in PDFs

What does PDF redaction actually mean?

Redaction is the permanent removal or concealment of sensitive information from a document before it is shared. In a legal or compliance context, true redaction means the underlying text or image data cannot be recovered — not even by copying and pasting, selecting hidden text, examining file metadata, or using data recovery tools.

This is critically different from simply drawing a black box on top of text in a PDF editor. Many people make this mistake: they cover sensitive content with a filled rectangle, save the file, and share it — not realizing the original text is still present in the document and can be trivially extracted.

In 2005, the NSA accidentally published a classified PDF report with text "redacted" using filled black boxes. Anyone who copied and pasted the blacked-out sections could read the underlying text. This kind of mistake is still extremely common in organizations using standard PDF annotation tools that don't truly destroy the original content.

The only way to truly redact a PDF is to rasterize the page — convert it from a text-layer document to a flat image — and then apply the black fill before burning the result into a new PDF. This destroys the original text layer, making recovery impossible.

How to redact a PDF properly (free)

Blurifyrenders your PDF page to a canvas in the browser using pdf.js, applies your redaction shapes as permanent fills, and packages the result into a new PDF using pdf-lib. The underlying text content is never preserved — what you see is what you get. Here's a step-by-step walkthrough:

Step 1: Open your PDF

Go to blurify.me and drag your PDF onto the upload area, or click to browse your files. Blurify supports single-page and multi-page PDFs. Your file is never sent to a server — everything runs locally in your browser using the File API and WebAssembly.

Once loaded, you'll see the first page of your PDF rendered at high resolution in the editor. The text should be crisp and clearly readable, making it easy to identify exactly what needs to be redacted.

Step 2: Switch to Redact mode

In the right panel, find the Mode toggle and switch from Blur to Redact. Redact mode fills your shapes with a solid black box — the internationally recognized standard for legal and professional document redaction. Every shape you draw in this mode will render as an opaque black rectangle or polygon.

Step 3: Draw rectangles over sensitive content

Select the Rectangle tool from the bottom toolbar and draw boxes over every piece of sensitive information you want to redact: names, addresses, account numbers, signatures, social security numbers, medical data, date of birth fields, or anything else that needs to be concealed.

You can draw as many shapes as needed on a single page. Each shape is added to the layers list in the right panel, where you can select, adjust, resize, or delete individual shapes. If you need to redact only part of a line of text — for example, blacking out only the account number in a sentence — use the Freehand tool to draw a precise custom shape around exactly the content you want to remove.

Step 4: Navigate pages and repeat

For multi-page PDFs, use the page navigation bar at the bottom of the canvas to move between pages. Your redactions on each page are saved automatically as you navigate — when you return to a page, all your previous shapes will still be there. Work through every page of the document, applying redaction shapes wherever sensitive content appears.

For long documents, focus on the pages most likely to contain sensitive data: cover pages (which often include full names, client details, and reference numbers), signature pages, financial schedules, and any appendices containing personal data.

Step 5: Export the redacted PDF

When all redactions are in place across all pages, click Export PDF in the right panel. Blurify renders each page with the redactions permanently applied and packages them into a single downloadable PDF file. The export process runs entirely in the browser — no data is transmitted to any server.

The resulting PDF is a rasterized document. Each page is a flat image with no selectable text, no hidden layers, and no embedded fonts or source data. The redacted areas are permanently filled and cannot be uncovered.

What types of information should be redacted?

The most commonly redacted categories of information in PDF documents include:

• Personal identifiers — full names, dates of birth, passport numbers, national ID numbers, social security numbers
• Contact information — home addresses, personal phone numbers, personal email addresses
• Financial data — bank account numbers, IBAN codes, credit card numbers, tax identification numbers, salary figures
• Medical information — diagnoses, treatment records, prescription details, insurance policy numbers, medical record numbers
• Legal information — case reference numbers, confidential attorney notes, sealed court exhibits, privileged communications
• Authentication credentials — passwords, API keys, secret phrases, or access tokens visible in screenshots embedded in a document
• Witness or informant details — names, contact information, or location data for protected individuals
• Biometric data — photos of faces, fingerprints, or other identifying physical features

When is PDF redaction required?

Many organizations and contexts require or strongly recommend PDF redaction before sharing documents:

• Legal proceedings — Court filings often require parties to redact personal data from exhibits before submission. Many courts have specific redaction rules governing which categories of information must be removed.
• GDPR and data protection compliance — Under GDPR and similar regulations, sharing documents containing another person's personal data without a legal basis is a violation. Redacting before sharing ensures compliance.
• FOIA and public records requests — Government agencies responding to Freedom of Information Act requests are required to redact exempt categories before releasing documents.
• Healthcare and HIPAA — Sharing medical records or clinical documents in the US often requires removing protected health information (PHI) to comply with HIPAA.
• HR and employment records — Internal HR documents shared between departments or with external auditors often need salary figures, home addresses, and personal identifiers removed.
• Due diligence and M&A — During mergers, acquisitions, or investment rounds, financial documents shared in data rooms often need to be partially redacted to protect commercially sensitive details.

Common redaction mistakes to avoid

Covering text with a black box without rasterizing the page

As described above, placing a black shape on top of text in standard PDF annotation tools (including Adobe Acrobat's basic annotation tools, many online editors, and Word's drawing tools) does not remove the text. It only adds a visual layer on top. The original content remains in the file structure and can often be extracted by selecting the text, using the Find tool, or stripping the annotation layer. Always use a tool that rasterizes the page and destroys the original text layer.

Forgetting document metadata

PDF files often contain embedded metadata: the document title, author name, creation date, last-modified date, software used to create the document, and sometimes revision history or comments. If any of this metadata contains sensitive information, it should be reviewed and stripped before sharing. Blurify's export creates a fresh PDF document that does not carry forward metadata from the original source file.

Redacting inconsistently across a long document

In multi-page documents, the same piece of sensitive information may appear multiple times — in headers, footers, reference fields, appendices, and running text. A systematic approach is essential. Work through every page and search for the sensitive terms you need to redact. A single missed instance on page 47 of a 50-page document can expose the very information you intended to protect.

Low-contrast or partial redaction

A redaction shape that only partially covers the target — leaving a few letters of a name visible at the edge, for example — is nearly as bad as no redaction at all in many contexts. Make sure every shape fully overlaps the content you're redacting, with a small margin of overlap around the edges. Blurify's preview updates in real time, so you can see exactly what will be covered in the final export.

Sharing the original instead of the redacted copy

The most common practical mistake is exporting the redacted PDF and then accidentally attaching or sharing the original file. Always double-check the filename before sending. Consider immediately renaming the redacted file to something clear like contract-REDACTED.pdf as a reminder.

Blur vs. redact — which is better for PDFs?

For most document redaction use cases, redact mode(solid black box) is the correct choice. Here's why:

• A black box is the universally recognized visual signal for redacted information in legal, compliance, and professional contexts. Reviewers immediately understand what it means.
• A blur effect on text can sometimes be partially reversed for high-resolution documents where the underlying letterforms are still partially discernible through the blur pattern. A solid black fill leaves nothing to recover.
• Some jurisdictions and legal standards explicitly require opaque black redactions. A blur might not be considered legally compliant in these contexts.

Blur mode is more appropriate for images embedded in PDFs — for example, blurring a face in a scanned photo page or softening a background in a brochure — where the solid-black aesthetic would look out of place.

Frequently asked questions

Does Blurify's redaction really remove the underlying text?

Yes. Blurify renders each PDF page as a rasterized image using pdf.js at high resolution, then applies the redaction as a permanent opaque fill before exporting the page into a new PDF document. The original text layer is destroyed in this process — there is no selectable text, no hidden content, and no way to recover the original data from the exported file.

Can I redact images embedded inside a PDF?

Yes. Because Blurify renders the entire page as a canvas image, it treats text, embedded images, charts, signatures, and all other content uniformly. You can draw a redaction shape over any visible content on any page, regardless of whether it is text, an image, or a combination.

Is there a page limit for PDF redaction?

There is no hard page limit. Blurify supports PDFs of any length, though very large documents may take longer to export because each page is rendered individually. In practice, documents of up to several hundred pages work without issue on modern hardware.

Will the file size change after redaction?

The exported PDF will generally be larger than the original if the original was a text-based PDF, because rasterized page images require more storage than compressed text. For PDFs that are already image-heavy (such as scanned documents), the size difference is typically smaller. This is an expected trade-off for genuine, permanent redaction.

Can I use Blurify redaction for official legal documents?

Blurify performs true permanent redaction by rasterizing page content before export, which meets the technical requirements for genuine redaction. However, specific legal proceedings, courts, and regulatory bodies may have their own requirements for how redaction must be performed and documented. For high-stakes legal filings, consult with your legal counsel to ensure compliance with the specific rules of the jurisdiction or court involved.

Does Blurify store a copy of my PDF?

No. Your PDF is opened locally using the browser's File API and processed entirely in memory using browser-native APIs (pdf.js and pdf-lib via WebAssembly). Nothing is transmitted to Blurify's servers. Closing the tab removes everything from memory — no copy of your document is retained anywhere.