Why drawing a black box is not PDF redaction

Hiding a sentence on screen does not necessarily remove it from a PDF. A safe redaction workflow must account for the visible page, its underlying objects and information stored elsewhere in the file.

The page is a stack of instructions

A PDF page can contain text, images, drawing instructions and annotations. Adding a black rectangle often adds another instruction above those objects. The covered sentence may still exist underneath. A reader might expose it through selection, text extraction, an annotation editor or another processing tool. The rectangle’s appearance tells you almost nothing about whether the source data survived.

The same problem applies to white boxes, highlights and cropping. A crop can change the visible window onto a page without deleting content outside that window. An annotation may be removable. A translucent highlighter can make words harder to read without obscuring them at all. Treat each of these as a presentation change unless the tool explicitly performs permanent removal and you verify the saved result.

A useful mental check is to separate the instruction “do not display this area” from “do not include this information in the output.” Those are different operations. When sharing a sensitive document, the second is the requirement. The exported file should not depend on the recipient choosing the same viewer settings or leaving your annotations untouched.

Redaction also requires deciding what counts as sensitive

Before opening a tool, identify the information you intend to withhold. A name may appear in a heading, a signature block, a table, a footnote and an attachment. An account number may appear as both text and a scanned image. Search helps with selectable words but will miss image-only content and may miss unusual character encodings.

Read the entire document, including appendices and apparently blank pages. Consider indirect identification: a job title, a unique date or a project code can identify someone even after their name is removed. The tool cannot decide the appropriate scope for your situation. For a regulated disclosure or formal legal process, use the relevant organisation’s review procedure and obtain qualified advice where necessary.

Make a working copy and keep the original in an appropriately protected location. Use a filename that clearly distinguishes the redacted version. Avoid putting the removed information into the new filename, an email subject or a delivery note. Redacting the PDF does not help if the surrounding message repeats the same confidential detail.

Two broad implementation approaches

An object-aware redaction engine edits the page’s content, removes intersecting text or image data and creates the redacted appearance. This is complex because text can be positioned through transformations, encoded through fonts, split across drawing commands or embedded inside reusable objects. Removing a matching plain string from the raw file is not a general solution.

A visual rebuild takes a different approach. It renders each page, fills the selected areas in that rendered representation and creates a new PDF using the completed page images. If implemented correctly, the original text objects, attachments and other source structures are never carried into the new file. The trade-off is that the output loses the original searchable text and interactive behaviour.

SandboxPDF’s Redact PDF uses the visual rebuild approach. It rebuilds every page, not just pages with marks, and does not attach the original PDF to the output. This is an important distinction from placing a rectangle over an otherwise unchanged page. It is still necessary to inspect the visible result and confirm that you marked every relevant location.

What the snapping brush does—and does not do

For selectable text, the redaction control can expand a drawn area to intersecting text runs. That helps cover the complete rendered text rather than leaving parts of letters exposed. A run can include more than one word, so snapping may cover more text than you expected. Review each mark and use Undo if the selected area is too broad.

Scans do not necessarily provide text coordinates. In that case, draw a rectangle that fully covers the sensitive pixels. Include a small visual margin around letters, punctuation and handwritten strokes. Zooming is useful, but also inspect the area at ordinary reading size to ensure that the surrounding document still makes sense. Do not assume the presence of OCR elsewhere makes every line accurately selectable.

Rotated pages need particular care because screen coordinates and PDF coordinates differ. Use the preview orientation shown by the tool, mark the sensitive area, and inspect the exported page rather than reasoning from the source file’s rotation setting. Pages can have different sizes and orientations within one document. A mark on one page should never be assumed to apply to another.

Hidden information is a separate review

Document properties can contain an author, title, creator application or timestamps. PDFs can also carry comments, attachments, form values and other structures that are not immediately visible. Removing a sentence from the page does not automatically address those items. Adobe’s own redaction workflow treats hidden-information removal as a distinct step after marking visible content. See Adobe’s redaction guidance.

In SandboxPDF’s visual redaction export, original source objects are discarded. However, information that remains visibly printed on an unmarked part of a page remains part of the new image. A visible author name in a footer will not disappear merely because metadata is removed. Review both the visible document and the export’s properties.

Do not confuse a metadata inspector with a universal detector of sensitive content. An inspector can list the structures it understands; it cannot recognise every personal detail in a photograph, drawing or paragraph. Sanitization and content review complement one another. Neither removes the need to decide what you are authorised to disclose.

Verify the saved output with several independent checks

First, reopen the downloaded file. Inspect every marked location and the surrounding text. Confirm that the cover areas are solid and that no letters, digits or image fragments remain at their edges. Count pages and ensure that the export has not silently omitted an appendix. Check rotated pages and pages with unusual dimensions explicitly.

Second, attempt text selection and extraction. A SandboxPDF visual redaction output should not contain the original searchable text layer. Searching for a removed word should not find it. But remember that a failed search alone is not proof of safety: a damaged text encoding can also make an unredacted word unsearchable. The check is useful alongside, not instead of, visual and structural inspection.

Third, inspect attachments, comments, form fields and document properties in a capable PDF reader. There should be no original attachment or hidden source document carried through this export. If your disclosure process requires forensic assurance or a particular certified workflow, have the file examined with the required specialist tools. A general browser utility cannot supply a legal certification simply because its button says “redact.”

Avoid breaking the redaction later

Once you have a verified redacted copy, use it as the source for subsequent distribution. Do not accidentally merge pages from the original back into it. Do not attach both versions to an email. If you run OCR on the redacted copy, recognise the already-redacted page images; never reuse a text layer extracted from the original document.

Adding page numbers or a delivery watermark afterwards can be reasonable, but each subsequent transformation creates a new file that should be checked again. Keep an explicit version trail: original, working redaction, verified delivery copy. If another person reviews the marks, share the appropriate working copy through an approved channel rather than placing originals in a public folder for convenience.

Digital signatures need special handling. Rebuilding or editing a signed PDF changes the document and normally prevents the original signature from remaining valid for the new bytes. Preserve the signed original when your records policy requires it. A redacted derivative and a valid signed original may need to be maintained as separate records with a documented relationship.

A realistic example: sharing a sample invoice

Suppose you want to share an invoice as a layout example. The customer name appears in the billing address, the account reference appears in the payment instructions, and a staff member’s email appears in the footer. The amount may also reveal commercial information. Decide which of these may remain before you start drawing. Covering only the large address block is an incomplete review.

Mark each location, export the redacted copy and check all pages. Inspect whether a QR code encodes payment or account information even though its appearance does not resemble ordinary text. If it does, redact the complete code. Check the filename and document properties for the customer’s name. The output should preserve enough context to demonstrate the layout without disclosing the information you intended to remove.

For simple property cleanup without deleting visible page content, use Sanitize PDF. For trimming a page for presentation, use Crop PDF and remember that cropping is not redaction. Keeping those operations distinct is one of the most useful habits you can develop when preparing documents for other people.