Redacting personal data in a filing: why a black box is not enough

A PDF is not an image file; it is a document made of drawing instructions. Inside it are records that say "these letters, in this font, at these coordinates". When you draw a rectangle over them in a viewer, none of those records change — one more drawing instruction is simply added to the file. They overlap on screen, so you see the text as covered, but the letters are still where they were.

In practice that means anyone who selects the area and copies it gets the text as it was. They do not even need to copy: any tool that extracts text — a search engine's indexer, a text extractor run from the command line — reads what is underneath without ever seeing the rectangle. The same applies to painting over the text with a highlight colour, drawing a white rectangle, or turning the text white.

This is why the method is written down as a security hole in Dosya Kalemi's own source, and why the tool never takes that route. The distinction is this: hiding changes the appearance, removing changes the content of the file. Redaction has to be the second one.

The method behind the Redact PDF tool is one sentence: the page you marked is redrawn onto a blank canvas, the boxes are painted over that drawing in solid black, and the resulting image takes the place of the original page. The new page holds no letter records at all, only pixels — so there is no text underneath to speak of.

This is the only route that truly destroys the text while staying inside the browser. Picking the text records apart one by one instead of redrawing the page is possible in theory but fragile: it requires knowing exactly which record a letter belongs to, how many pieces a word was split into, and what font subsets give away. Redrawing the page makes all of those questions unnecessary.

The whole operation happens in your tab. The document is not uploaded anywhere, and nothing leaves — including the coordinates of the areas you want covered. When redaction is the task, that detail matters: hiding something by sending the file to a server means copying the very thing you are trying to hide one more time.

A redrawn page keeps no text layer. On that page you can no longer search, select or copy text, and a screen reader cannot read it. That is the unavoidable consequence of the method — it is exactly what genuinely removing the text amounts to.

The loss is limited to the pages you touched. The tool does not turn the whole document into images: only pages carrying a marked box are redrawn, and the rest keep their original form with their text layers intact. Redact two pages of a hundred-page file and ninety-eight pages stay searchable.

Three levels set the sharpness of the output: screen at 110 dpi, good at 150 dpi, print at 220 dpi. A higher level preserves legibility but grows the file, and that difference becomes noticeable when many pages are redacted. For a text-heavy filing 150 dpi is usually enough; where small print or writing on a seal matters, 220 dpi is the safer choice.

Hunting for ID numbers or account numbers in a long file is the kind of work people are worst at: repetitive, attention-hungry, and ruined by a single miss. So when you open a file the tool scans the text layer itself and offers ready boxes for what it finds. Five kinds are looked for: national ID number, IBAN, phone number, licence plate and email address.

How much you can trust a suggestion varies by kind, and that is deliberate. ID numbers and IBANs carry their own checksums, so a candidate is flagged not merely because it matches a digit pattern but because the checksum holds — false flags are close to nonexistent. Phone numbers and plates have no such guarantee, so an unrelated number can turn up as a suggestion. The trade is intentional: deleting a box that should not be there takes a second, while noticing an ID number you missed is often not possible at all.

One limit is worth knowing up front: the scan reads the document's text layer. A scanned filing — one whose pages are photographs — has no text layer to read, so no suggestions appear and the boxes have to be placed by eye. And the suggestions are help, not a guarantee: which boxes stay is your decision, and the final check is always yours.

Cropping is not redacting. The Crop PDF tool narrows the area of the page that gets shown; the content left outside stays in the file, and because cropping can be undone it can be made visible again. To remove something at the edge of a page for good you need redaction, not cropping.

Compressing is not redacting either. Making a file smaller does not delete text that has a rectangle drawn over it; if compression takes the lossless route the text layer survives untouched and can still be copied. Assuming that solving the size problem also solved the confidentiality problem is the most common way these two jobs get confused.

Finally, redaction cleans the content of the page, not the rest of the file. A file name can carry information of its own, and the document properties can hold records such as an author name. Looking at the file name and checking the document properties before you send sits outside redaction proper, but belongs to the same job.