Cover Sensitive Areas in a PDF
Place black boxes over text or images for a visual review copy. This tool does not guarantee that the covered data is removed.
How to redact a PDF — 3 steps
- 1
Add the document
Drop the PDF in. It is opened in your browser, which matters more here than anywhere else — a document you are redacting is by definition one containing information that must not leak.
- 2
Mark what has to go
Draw over every name, number, address, or image that must be removed. Work page by page rather than from memory; sensitive details have a habit of reappearing in footers and appendices.
- 3
Export a review copy
Download the covered copy and inspect it visually. This editor adds black rectangles; it does not prove that the original text or image data has been removed.
Why a black box needs a warning
A PDF page has layers. The text sits in the content stream as characters at coordinates; a shape drawn over it is another object placed on top. Visually the text disappears. Structurally it is exactly where it was — selectable, copyable, and searchable. Anyone can drag a cursor across the black bar and paste out what it was hiding, and it takes no expertise whatsoever.
This is not a hypothetical failure. Court filings, government reports, and corporate disclosures have all been published with black rectangles over names that were recovered within hours of release, sometimes by people who simply copied and pasted out of curiosity. The same applies to highlighting text in black, changing the font colour to white, and covering content with an opaque image — each hides the pixels and leaves the data.
Real redaction removes the underlying content before covering the area. This editor does not make that guarantee, so the downloaded file should be treated as a visual review copy rather than a safe release copy. Use a workflow that removes the data when privacy or legal disclosure matters.
The places sensitive data hides outside the page
Redacting the visible page is necessary but not always sufficient, because a PDF carries material that never appears on screen. Document metadata records the author, the originating software, and often an internal filename or draft title. Bookmarks and the table of contents can quote section headings verbatim, including the name of the party you just redacted. Attachments, comments, form field values, and layers all persist independently of the page content.
Images deserve particular attention. A redaction applied over a photograph or a scanned signature must remove that image data, not merely obscure part of it — and where a page is a scan, the text you are removing is part of the image, so the redaction has to alter the pixels themselves. It is also worth remembering that a small, cropped, or downscaled version of an image can be embedded separately as a thumbnail.
A sound routine covers all of it: redact the page content, then strip the metadata, then check bookmarks and any attachments, then open the finished file fresh and search it for the terms you removed. Where the document is going into litigation, a regulatory filing, or a freedom-of-information response, treat that verification as part of the work rather than a courtesy — the cost of getting it wrong is that the information is public permanently.
Your files never leave your device
Redaction runs entirely in your browser. Uploading a document to a third-party server in order to remove confidential information from it defeats the purpose, and here the file never leaves your machine.
Most online PDF sites upload your document to their servers, process it there, and keep a copy for minutes, hours, or longer. PilotPDF works differently: the page downloads a small processing engine into your browser, and your file is opened and edited in your device's memory using WebAssembly. Nothing is transmitted, so there is nothing for a server to store, leak, or scan. You can even disconnect from the internet after the page loads and the tool keeps working.
Read more about how this works in our privacy-by-design explainer.