How to Redact a PDF Properly: Hide SSNs, Account Numbers and Other Private Details

Sooner or later, almost everyone has to share a document that contains something they would rather not share. A landlord wants a pay stub, but not your full Social Security number. A lawyer needs a bank statement, but not every transaction. A school asks for a medical form, and you only want to send the page that matters. The obvious fix is to draw a black rectangle over the private text and save. It looks perfect on screen, and it is one of the most common ways private information leaks. Here is what real redaction means, how to do it, and how to prove to yourself that it worked.

Why a black box is not enough

A PDF is built in layers. The text sits on one layer, and anything you draw sits on top of it. A rectangle, a highlighter set to black or a white box all work the same way: they hide the words visually, and leave them in place underneath.

Anyone who opens that file can often select the area, copy it and paste the "hidden" text into an email. Others delete the rectangle in an editor and the original is back. This has exposed real material before, including legal filings and public records where the blacked-out passages were readable by copy and paste.

True redaction is different. It permanently removes the text or image beneath the mark, so there is nothing left to recover.

What you should redact

Think about who will read the document and what they actually need. Common items worth removing before you share:

• Social Security numbers. Many forms only need the last four digits. Black out the rest.
• Bank and credit card numbers. Keep at most the last four digits.
• Dates of birth, home addresses and phone numbers when they are not required by the recipient.
• Driver's license and passport numbers, and any barcode or machine-readable strip that repeats them.
• Names of other people, such as children, patients or other tenants, in documents that mention them.
• Account balances or transactions that are unrelated to the reason you are sharing the statement.

One caution: do not redact anything the recipient is entitled to see or has asked for. A lender who requires a full bank statement may reject a version with large areas missing. When in doubt, ask what they need before you start.

How to redact a PDF step by step

1. Open Redact PDF and add your file. It is processed in your browser, so the document is not uploaded anywhere.
2. Drag boxes over the sensitive areas. Make each box slightly larger than the text, so no edge of a letter peeks out.
3. Use Find to mark a name or number everywhere it appears, or the quick buttons for Social Security numbers, email addresses, phone numbers and card numbers. This is faster, and it catches repeats you might miss when scrolling.
4. Review every mark. Automatic matching is a helper, not a guarantee, so look at each page once more.
5. Click Redact, then download the new file. Keep your original somewhere safe and send only the redacted copy.

Each page with a mark is rebuilt as an image of the page with the black boxes burned in. The text, images and comments under the boxes are no longer in the file. Pages without any marks are copied unchanged, so the rest of the document stays sharp and searchable.

Test it before you send it

Do not trust a redaction you have not tested. It takes a minute:

1. Try to select the area. Open the new file and drag across the black box. Nothing should highlight.
2. Search for it. Press Ctrl+F (Cmd+F on a Mac) and search for a word or number you removed. There should be no match on the redacted page.
3. Copy and paste. Select the whole page, copy it and paste it into a blank note. The hidden content must not appear.
4. Zoom in. Check the edges of each box at 200 percent for stray fragments of letters.

If anything shows up, the redaction did not work. Go back to your original and try again.

Do not forget the hidden places

Sensitive details do not live only in the visible text. Before sending, check these:

• Document properties. The title, author and subject fields sometimes contain a full name or a file name such as "Smith-John-SSN-123.pdf". You can clear them in Redact PDF, or review them with Edit PDF Metadata.
• The file name. Rename it so it does not repeat what you just removed. Our guide on naming PDF files has simple conventions.
• Other pages and attachments. A number removed on page 1 may be repeated in a footer, a form field or the last page.
• Comments and form fields. Sticky notes and filled-in fields can store text separately from the page.

For a deeper look at what a PDF carries around, read PDF metadata and privacy.

Redaction, passwords and sharing

Redaction and passwords solve different problems. Redaction removes information from the document for everyone. A password limits who can open it at all.

• If the recipient should never see a detail, redact it.
• If the recipient should see everything, but strangers should not if the email goes astray, add a password with Protect PDF.
• If both apply, redact first, then protect the redacted file. Send the password through a different channel, such as a text message.

Keep in mind that a password is a safeguard, not a guarantee. Anything you would be uncomfortable seeing in the wrong inbox is better removed than locked.

Common mistakes

• Using a highlighter or shape tool. It looks right and protects nothing.
• Changing text to white. The text is still there and still selectable.
• Redacting a copy, then sending the original. Name the redacted file clearly, for example "-redacted", and double check the attachment.
• Skipping the test. One search and one copy-and-paste catch nearly every failure.
• Redacting too little. Leave out only what the recipient truly needs.