Open any PDF where something has been blacked out. Click just above the black bar, drag your cursor across it, and press Ctrl+C. Now paste into a text box.
If words appear, that document was never redacted. It was decorated.
This takes about five seconds, requires no tools, and it is how thousands of confidential names, addresses and account numbers have been recovered from documents that their authors believed were safe to publish.
It keeps happening to people who should know better
In December 2025 the Department of Justice published roughly 3.5 million pages in compliance with the Epstein Files Transparency Act. The redactions did not hold up. Reporters found identifying material that was supposed to have been removed, and at least sixteen files were quietly pulled from the DOJ website after publication.
This was not a novel failure. When Paul Manafort's lawyers filed a court document in 2019, the sensitive passages were covered with black bars. Journalists copied the text out from underneath them the same afternoon. The American Bar Association maintains a whole article on the genre, because it recurs often enough among law firms and government agencies to be a recognised category of mistake.
These are organisations with legal review, compliance departments and real consequences for getting it wrong. If they get caught by this, the assumption that it is a careless-user problem is not right. The tools are misleading.
Why a black rectangle hides nothing
A PDF is not a picture of a page. It is a set of instructions: draw this text, in this font, at these coordinates. Underneath what you see there is a text layer holding the actual characters, which is what makes a PDF searchable and copyable in the first place.
When you draw a black rectangle in a PDF viewer, you add one more instruction to that list: draw a filled shape at these coordinates. You have added something on top. You have not removed anything underneath.
The result looks identical to a redacted document on screen. But the text layer is untouched, so the words are still selectable, still searchable, and still sitting in the file for anyone who opens it in an editor, extracts the text programmatically, or simply drags a cursor across the bar.
The same applies to highlighter tools set to black, to shapes pasted in from another app, and to anything described in a menu as an annotation or a markup. An annotation is by definition a layer over the document, not a change to it.
How to check a document you have already sent
Three checks, in increasing order of thoroughness:
- Select and copy. Drag across the blacked-out region and paste elsewhere. Hidden text shows up immediately.
- Search the file. Use Ctrl+F to search for something you believe was removed, like a surname or the digits of an account number. If the viewer jumps to a black bar, the text is still there.
- Extract everything. Run the document through a text extractor and read the output. This catches material that is invisible on screen for other reasons, such as white text or content hidden under an image.
If you would rather not upload a confidential document to a website to run that last check, that instinct is exactly right, and it is why our PDF to Text tool does the extraction in your browser instead.
What real redaction actually does
Genuine redaction destroys the content. The words must be gone from the file, not covered within it, so that no amount of selecting, searching, extracting or editing brings them back.
There are two ways to achieve that. You can rewrite the PDF's internals to delete the specific text objects, which is precise but fiddly and easy to get subtly wrong. Or you can render each page to an image, burn the black boxes into the pixels, and rebuild the document from those flattened pages. The second approach is what most legal and government redaction workflows rely on, because its guarantee is easy to reason about: after rasterising, there is no text layer left to leak. There is only a picture of a page with a black box painted onto it.
That is the approach our Redact PDF tool takes. You draw the boxes, every page is re-rendered with them burned in, and the document you download has no recoverable text underneath.
The trade-off nobody mentions
Rasterising is a real cost, and any tool that does not tell you about it is selling you something.
When a page becomes an image, the whole page becomes an image. The document stops being searchable, text can no longer be selected or copied from any part of it, screen readers lose the text layer, and the file usually gets larger. You are trading the convenience of a live text layer for the certainty that nothing is hiding in one.
For a contract you are sending to a counterparty, that is almost always the right trade. For a 400-page report where you need to remove two names and keep the rest searchable, it is worth pausing over.
Anyone offering redaction with no downside at all is either doing the precise object-deletion approach and should say so, or is drawing rectangles and calling it redaction.
If you have already published something
Assume the original is recoverable, because it usually is. Take the document down first, since every minute it stays up is another chance for it to be mirrored. Redact it properly from the original file rather than from the already-published version, then check the new file with the copy-paste test before you republish. If the material was sensitive enough to redact, treat the window it was public as a disclosure and handle it accordingly.
The short version
A black rectangle is a drawing, not a deletion. If you can select the text underneath, so can anyone else, and they do not need any tools to do it. Test your documents with five seconds of copy and paste before they leave your hands, and when you do redact, use something that removes the content rather than covering it.
Ours runs entirely in your browser, which means the unredacted original, the version you are most worried about, never travels anywhere to get cleaned up. Try Redact PDF.