The form is finished. Someone else needs a copy — opposing counsel, a landlord, an agency asking for supporting documents. What they must not receive is the Social Security number on it. So you draw a black rectangle over the number and send it.
The number is still in the file, underneath the rectangle. Anyone who selects that part of the page and pastes it elsewhere gets it back. The usual way people find this out is that somebody else finds it first.
If you have Acrobat Pro, use its Redact tool — Adobe's genuinely removes the content, and that is the right answer even though it isn't ours. If you don't, and the document is an ordinary text PDF of up to 30 pages, Filly's redaction flattens the affected pages to an image, so there is no text left to recover (2 credits). If it is a scan, no text-based tool touches it — Filly's included — so cover the value in an image editor or drop the whole page. If you only need to mark a document's status, you want a watermark, not redaction. Whichever you use, run the test below first.
Six ways people black out a PDF, and what survives each one
| Method | Recoverable by copy-paste | Found in a .txt dump | Exposed to the glyph-position attack |
|---|---|---|---|
| Black rectangle drawn over text | Yes | Yes | Moot — text survives |
| Text highlighted in black | Yes | Yes | Moot — text survives |
| White text on a white background | Yes | Yes | Moot — text survives |
| Delete the whole page | No | No | No |
| Acrobat Pro's Redact tool, applied | No | No | Yes — the 2023 research covers this |
| Render the page to an image, then box it | No | No | Reduced, not eliminated — width still leaks |
What a black box actually is
A PDF keeps its text in a content stream and its markup in a separate annotation layer. A rectangle drawn with a shape, highlight or comment tool lands in the annotation layer, on top; drawing it does not edit the stream underneath. The page renders as a black bar while the file still holds the characters, and every text extractor reads the stream, not the picture.
Real redaction deletes from that lower layer — or replaces the page with one that has no lower layer at all.
The two-minute test that settles it
Don't take any tool's word for this, ours included.
Quick version: open the redacted PDF, select the whole page, copy, and paste into a text editor. If the value appears, the file was never redacted.
The version that proves it: dump the text layer to a .txt file and search it for the value — copy-paste depends on how your viewer handles the selection; a dump doesn't. Filly's PDF-to-text tool returns a searchable .txt for documents up to 30 pages; pdftotext does the same locally, with no page limit. If the number is in the .txt, it is in the document, whatever the page looks like.
An extractor that returns no text at all tells you something else: the document is a scan, which changes everything.
One failure, one warning, one attack
Paul Manafort's court filing, January 2019. His lawyers filed a response to the special counsel's allegations with passages blacked out. Filed on 7 January and public on 8 January, it gave up the hidden text the same day by the mechanism above: select, copy, paste, read. BuzzFeed News described copying text out that way as "a function that isn't supposed to work" on a properly redacted court document. Here it worked.
The NSA's guidance, December 2005. Fourteen years earlier the National Security Agency published Redacting with Confidence: How to Safely Publish Sanitized Reports Converted from Word to PDF (report I333-015R-2005). It names three recurring mistakes: covering text, charts or diagrams with black rectangles, or highlighting text in black; blacking out part of an image or shrinking it to illegibility; and leaving metadata and document properties in place. Its principle: information hidden or covered in a computer document can almost always be recovered, so sensitive content must be removed by deletion, not made illegible.
The glyph-position paper, 2023. The uncomfortable one, because it applies to redactions done correctly. In Story Beyond the Eye: Glyph Positions Break PDF Text Redaction (Bland, Iyer and Levchenko, University of Illinois Urbana-Champaign, Proceedings on Privacy Enhancing Technologies 2023(3), 43–61), the authors show that when a tool removes text and draws a box, the characters around it still carry sub-pixel spacing that depends on what used to be there. Measure the gap, narrow the candidates: a typical PDF authored in Word leaks about 13 bits about a redacted surname, enough to pick one individual out of 8,000. Of the 11 redaction tools they surveyed, including Adobe's, two removed nothing at all — CVE-2022-30350 and CVE-2022-30351. They de-redacted hundreds of real redactions, in Office of Inspector General reports and FOIA responses.
It is also the reason not to overclaim for flattening. The same paper finds that rasterising a page increases a redaction's security but does not remove the leak: pixels outside the black box are untouched, so the width of what was there can still be read off the spacing on either side — about 11 bits in vector form, roughly 8 bits once quantised to 300 DPI. Better, not perfect.
What actually has to be removed
For filings in US federal civil cases, Federal Rule of Civil Procedure 5.2(a) is the concrete standard, and it is narrower than people assume: unless the court orders otherwise, a filing may show only the last four digits of a Social Security or taxpayer-identification number, only the year of an individual's birth, only a minor's initials, and only the last four digits of a financial-account number.
Outside court the set is longer: full SSN or ITIN, date of birth, bank and card numbers, an A-number, passport or licence numbers, third-party names. Which matter is situational — a prior address is harmless in a tax packet and dangerous in a protective-order filing. Only the sender knows what has to go.
The scanned-document case
A PDF from a scanner or a phone camera has no text layer, so a text-based tool has nothing to find. Filly's returns "No PII found to redact in this document" rather than a file that merely looks redacted.
Two things work instead. Drop the page, if the value sits on one you can afford to lose. Or export the pages as PNG or JPEG, paint over the value, and rebuild the PDF from the edited images — tedious, and genuinely secure, because you are editing pixels. Don't run OCR and assume it settled the matter: OCR adds a text layer, it removes nothing, and what it misreads is a value no text-based tool will find.
Where Filly fits, and where it does not
Filly's redaction reads the text layer, asks an AI model which items are personal data, then re-renders each affected page as an image at roughly 144 DPI, paints black over the located items, and rebuilds the page from that image. Pages with nothing to redact are copied through untouched, so the output is part text, part flattened — and the flattened pages have no text layer left.
The limits, because they decide whether it suits you:
- 2 credits, not 1. Most toolbox operations cost one credit; redaction, AI page-organising and conversion cost two. Credits are charged on the free plan; paid plans, from $19 a month billed monthly, include the toolbox.
- 30 pages maximum — above that it errors rather than processing part of the file — and it cannot touch a scan.
- No preview step, and detection is a first pass, not a compliance review. It finds and applies in one call, so the review that matters is the one you do on the output. An unusual account-number format, a name inside a sentence, a handwritten note — any can be missed.
- Metadata is a separate exposure — see the FAQ below. Nothing here audits it for you, and untouched pages keep their annotations.
- No public API, and the free plan covers 10 fills a month and 10 credits on signup.
For a regulated disclosure with legal exposure — a subpoena response, a records release under HIPAA — a person reviews the output before it goes. Software finds candidates faster than a human reads; it doesn't carry the consequence. If those releases are routine, the records-release side of it is worth reading alongside this, and the security page covers storage and deletion.
A watermark is not a redaction
A watermark stamps DRAFT, COPY or CONFIDENTIAL across the page. That tells a human its status, which is useful — it stops a working version being signed and filed as final. But it removes nothing and comes off in any PDF editor. If you need a value not to be in the file, a watermark does no part of that job.
Frequently asked questions
Is a black box over text in a PDF really redaction?
No. A rectangle drawn with a shape, comment or highlight tool sits in the annotation layer, above the text. The characters stay in the content stream and come back out with copy-paste.
How do I check whether a PDF was properly redacted?
Extract the text layer to a .txt file and search it for the value you removed. If it's there, the document isn't redacted, whatever it looks like. Filly's PDF-to-text tool produces the .txt; pdftotext does the same locally.
Can you redact a scanned PDF?
Not with a text-based tool — there is no text to find. Filly reports that it found nothing rather than returning a file that only looks redacted. Either remove the page, or export the pages as images, paint over the value, and rebuild from them.
Does flattening make the file impossible to read?
No — it stays readable to a person. What it loses is machine access: flattened text is no longer selectable, searchable or copyable, and screen readers can't read it. Redact as few pages as you can.
Is AI redaction good enough for a court filing?
Treat it as a fast first pass. It finds candidates; it doesn't know your matter and can miss an unusual format. For anything with legal consequence, a person checks the output against the standard that applies — Rule 5.2 for federal civil filings.
Does redacting remove the document's metadata too?
Not as a rule — assume not unless the tool says otherwise. The NSA's guidance lists metadata and document properties as an exposure separate from visible content, and Acrobat treats sanitising hidden information as a step distinct from applying redactions. Filly's output is a newly built file, so the original's document-level properties don't survive — but nothing inspects it for you.