Why PDF black boxes are not redaction

How does a PDF store the text you think you covered?

A PDF page is not a bitmap. It is a content stream: a stack machine of operators that position glyphs, draw paths, and paint XObjects. The letters of a Social Security number are typically TJ or Tj operators with font resources. A black rectangle is a separate path fill. Both can coexist. Screen readers, pdftotext, and “select all” walk the text operators, not the pixels you see in Preview.

Annotations make this worse. Many “highlight and black out” tools add a square annotation with a black appearance stream. The annotation sits in the page’s Annots array. The original content stream is untouched. Removing the annotation restores the text. Incremental saves can even keep older generations of the file in the same bytes.

What does real redaction change in the file?

Redaction is a rewrite. You identify the content to destroy, remove or replace the corresponding operators, and garbage-collect unused objects. Images that contain the secret must be cropped or re-encoded. Form fields that store the value in /V must be cleared. Document Info and XMP metadata often repeat names, titles, and author emails.

In the browser this work happens with pdf-lib or a similar parser: load the PDF into memory, mutate page content, then save a new Uint8Array. There is no server-side ghost copy unless you chose an upload tool.

• Delete or rewrite text showing operators for the target region.
• Replace image XObjects that still contain the pixels.
• Drop unused fonts, metadata, and previous incremental updates.
• Verify with copy-paste and a text extract after download.

How do you redact a PDF in the browser?

Open the local redactor, pick the file from disk (File API — no multipart POST), mark regions, and export. The new file is a download from a blob URL. Confirm Network shows no upload of the PDF body.

const bytes = await file.arrayBuffer();
const pdf = await PDFDocument.load(bytes);
// mutate page content, then:
const out = await pdf.save();
const url = URL.createObjectURL(new Blob([out], { type: "application/pdf" }));

Why do cloud “PDF editors” fail this test?

A remote editor must receive the file to draw it. That is an upload, a retention policy, and a log line. Even if they draw black boxes correctly, you have already transmitted the unredacted original. For contracts, medical PDFs, and HR packs, that is the incident. Client-side tools keep the unredacted bytes in the tab until you overwrite them locally.

How should you verify a redacted export?

After download, search the PDF for a distinctive token you meant to destroy. Copy a rectangle that used to contain text. Open the file in a hex editor and search for the ASCII of the secret if it was unencrypted. If you still find it, the tool painted; it did not redact.

Frequently asked questions