A finance officer at a small charity sent a grant report to a funder. The bank details on page four were covered with a neat black box drawn in a free PDF editor. Two days later the funder replied and quoted the account number back, having copied it straight out of the file. Nothing had ever been removed. The box was decoration.
That gap between what a document looks like and what it contains is the subject of this guide. It is not really a technical topic. It is a habit, and once you have it, it costs about ninety seconds per file.
Redaction means removal, not concealment
Three different things get called redaction, and only one of them is safe.
Visual hiding places something on top: a rectangle, a highlight, a sticker, a crop. The original content is untouched and sits underneath, still selectable and still searchable.
Permanent removal deletes the underlying content from the file itself, then rebuilds the page so there is nothing to recover.
Flattening merges everything into a single fixed layer. Think of a page built from transparent sheets stacked on top of each other. Flattening photographs the finished stack instead of shipping the sheets, so nobody can lift one off to see what was beneath it.
Proper redaction combines the last two. The information goes, and the result is exported as a new file rather than saved back over the original.
What is actually at stake
The risk is rarely dramatic. It is usually small pieces of information doing more work than you expected. An account number and a sort code are enough for fraudulent direct debits. A name, a date of birth, and a home address are the standard ingredients of identity theft. A customer reference number is often all a call centre needs before it will discuss an account.
Confidentiality matters too. Pricing left in a proposal template tells a client exactly what you charged the last one, and a supplier name in a shipping document can reveal a relationship a company spent years keeping quiet.
Then there are obligations. Data protection rules in most countries require organisations to share only what is necessary, and courts, regulators, and funders often specify what must be withheld. Failing to redact can be reportable, not merely embarrassing.
Finally there is personal safety. For someone who has left an abusive relationship, an address on a scanned letter is not an administrative detail. It is the piece of information that matters most.
The mistakes that cause most leaks
Almost every real incident comes from one of a small set of habits.
Drawing a black rectangle is the classic. In a PDF it is normally an annotation floating above a live text layer, so the text underneath can still be selected, copied, or extracted. The highlight tool is worse, because many highlighters are semi transparent by design.
Cropping a screenshot feels safe, but some phone and desktop editors have historically written the cropped result back into the original file without discarding the removed pixels, allowing part of the original to be recovered. Cropping also does nothing about what sits inside the visible area.
Light blurring and coarse pixelation are the most over trusted options. Over a long paragraph they are usually fine in practice. Over a short, predictable string such as a sixteen digit card number, researchers have repeatedly shown the original can be narrowed down, because only so many inputs could produce that pattern.
Sharing an editable file is a mistake in itself. If the recipient can open your document in the tool you used, they can move your shapes, undo your edits, and read your comments.
Then there is everything that never appears on the page: metadata, comments, form field values, and revision history. Those get a section each below.
What this looks like in real work
A freelancer sending an invoice. Bank details and the client's contact name should go. The date, the line items, and the total stay, because those are the point of sharing it.
A journalist protecting a source. Names and signatures are the obvious removals from a leaked thread. The quieter risks are the email headers, the internal ticket number, and the phrasing of a sentence only three people would use.
A doctor preparing a case study. Teaching material needs the clinical picture, not the person. Name, hospital number, exact dates, and the scan's embedded patient details go. Age band, symptoms, and treatment sequence stay, because removing those destroys the teaching value.
The same logic applies elsewhere.
| Situation | Remove | Keep |
|---|---|---|
| Teacher sharing student work as an example | Student name, class list, marks of other pupils | The work itself, the task brief, your feedback |
| HR manager circulating interview notes | Candidate name, contact details, references to protected characteristics | Scores against the criteria, panel comments on skills |
| Landlord sharing a tenancy agreement | Tenant names, previous addresses, guarantor and bank details | Clauses, rent amount, dates, property terms |
| Developer posting logs for help | API keys, tokens, internal hostnames, customer identifiers, real email addresses | Error messages, stack traces, timestamps, version numbers |
| Sending a passport copy | Passport number if the recipient does not need it, and the machine readable strip at the bottom | Name, photo, and expiry date if identity is the point |
| Selling a house | Your bank details, mortgage account number, previous occupants' names | Survey findings, floor plans, boundary information |
| Posting a screenshot online | Notification previews, other browser tabs, file paths, usernames, order numbers | The part of the screen that makes your point |
The pattern is the same every time. Ask what the recipient actually needs to do their job, and remove the rest rather than the other way round.
PDFs hold more than the page you see
A PDF is not a picture of a document. It is a container, and it can hold a searchable text layer beneath what looks like a scan, an OCR layer added by a scanner app, annotations, filled form fields, attachments, and document properties.
That is why a scanned contract can still be fully searchable, and why a form you filled in and printed to PDF still carries the values you typed. The PDF Metadata Viewer shows the properties side of this, including the title and author that often survive from an old template. Our guide to what a PDF quietly records about you covers that layer in detail.
Flattening closes the gap. It converts the page into fixed content, so the text layer, the annotations, and your redaction marks can no longer be pulled apart.
Images keep their history
Photographs carry EXIF data: camera or phone model, the exact time, settings, and often GPS coordinates. A photo of a document taken at home can therefore reveal the home.
Screenshots usually carry less metadata but capture more context than people intend. Notification banners, other browser tabs, a file path in a title bar, and a signed in account name are all common. Look at the whole rectangle, not just the part you meant to share.
Painting over text is only safe if the paint is opaque and the file is exported flat. A soft brush at partial opacity leaves a readable ghost, and a layered format such as PSD keeps your paint as a separate layer anyone can hide.
Word documents remember what you deleted
A .docx file is designed to preserve history. Tracked changes hold the text you removed. Comments hold the discussion about it, including ones marked resolved. Document properties hold the author, the company, and sometimes the file path. Text can be formatted as hidden and still travel with the file.
This is why exporting to PDF before sharing is usually safer. A clean export drops most of that hidden material, and you are then redacting a simpler object. Export rather than rename, and redact after the export rather than before it. Our comparison of PDF, Word, and image files covers the wider trade offs.
Blur, pixelation, and real redaction compared
| Method | What it does | Where it fails |
|---|---|---|
| Blur | Averages nearby pixels so shapes soften | Short predictable content can be narrowed down, and strength is hard to judge by eye |
| Pixelation | Replaces a block of pixels with one average colour | Coarse blocks over known formats such as card numbers have been reversed |
| Solid fill on a flattened export | Replaces the pixels entirely, with nothing beneath | Only fails if you forget to flatten, or the same detail appears elsewhere in the file |
Blur and pixelation have a legitimate place: a face in a crowd, a number plate in the background, a long block of body text. The trouble is that they look equally convincing whether they are strong or weak, which makes them a poor choice for anything you would not want quoted back to you.
Doing it properly
Once the difference is clear, the steps are mechanical. A realistic sequence before emailing a document looks like this.
- Duplicate the original and work only on the copy
- If the source is a Word file, export a fresh PDF rather than renaming one
- Read the whole document once, listing what has to go and what has to stay
- Cover every one of those areas, including repeats in headers, footers, and appendices
- Flatten and export a new file rather than saving over your working copy
- Verify the export, then attach that file and nothing else
BlinkCalc's Redactor follows that sequence for PDFs, images, screenshots, and Word documents. You mark the areas, review each one, and export a flattened copy, and because the processing happens in your browser the original does not need to be uploaded to a server. If your organisation has approved software for regulated documents, use that instead. The principle matters more than the tool.
Verification is the step people skip. Reopen the exported file, try to select and copy the covered regions, and search for the exact names and numbers you removed. Pulling the text out with the PDF to Text Extractor shows quickly what a machine can still read. If the file also needs to be smaller for email, run Compress PDF afterwards and check the compressed copy again, since that is the version people actually receive.
Before you send
Run through this after the export, not before it.
- Search the final file for each name, number, and address you removed
- Try to select and copy every area you covered
- Check the document properties for a stale title, author, or company
- Scroll the whole document, including appendices, headers, and footers
- Confirm comments, tracked changes, and form field values are gone
- Open the file in a different application than the one you used to edit it
- Check the file name itself, since
smith-jane-dismissal-final.pdfannounces plenty on its own
Beliefs worth abandoning
| Belief | What actually happens |
|---|---|
| "I covered it, so nobody can read it" | The covering shape is a separate object above intact content |
| "If I cropped it, it is gone" | Some editors keep the discarded pixels, and cropping ignores everything inside the frame |
| "Blur is enough" | Strength cannot be judged by eye, and short predictable strings are guessable |
| "I deleted the page" | Deleting a page does not remove metadata, attachments, or the same detail repeated elsewhere |
| "I exported it, so it is clean" | Export drops some hidden layers but faithfully carries anything visible, including your black boxes |
What redaction cannot do
Redaction protects one file. It cannot protect information that is still visible somewhere else, and that is the limitation people underestimate. If the name you removed from page six appears in the file name, the covering email, an earlier version already sent, or the table of contents, the redaction has achieved nothing.
Automatic detection is useful for patterns such as email addresses and card numbers, but it misses names written in unusual ways, handwriting in a scan, and anything identifying by inference rather than by format. OCR on a poor scan is imperfect in both directions, so it can miss text and invent it.
Context can unmask content that was correctly removed. A document that says "one of our three regional managers" narrows the field considerably. Removal is a technical step; deciding what to remove is a judgement, and only someone who understands the document can make it.
None of this argues for doing less. It argues for treating the export as a draft until you have checked it, and for keeping a clear line between working files and shareable ones.
FAQ
What is the difference between hiding and redacting?
Hiding puts something on top of the information, such as a black box or a highlight, while the original content stays in the file. Redacting removes the information from the file and rebuilds the page so there is nothing left underneath to recover.
Can someone recover text under a black box?
Often yes. If the box was drawn as an annotation or shape over a live text layer, the text can usually be selected, copied, searched, or extracted, and in some editors the box can simply be dragged away.
Should I blur personal information?
Blur is better than nothing but weaker than removal. Short predictable content such as an account number or a date of birth can sometimes be reconstructed from a light blur or a coarse pixelation. Use a solid fill on a flattened export for anything that matters.
Can screenshots contain hidden data?
Yes. Photos usually carry EXIF data such as camera model, time, and sometimes GPS location. Screenshots normally carry less, but they often capture more of the screen than you intended, including notifications, browser tabs, file paths, and account names.
Can Word documents contain hidden information?
Yes. A .docx file can hold tracked changes, resolved and unresolved comments, earlier revisions, hidden text, and document properties such as author and company. None of that is visible on the printed page.
Should I review a redacted file before sharing?
Always. Reopen the exported copy, try to select and copy the covered areas, run a text search for the names and numbers you removed, and check the document properties. Automatic detection misses things, so the final check should be human.