Drawing a black box leaves the text underneath fully recoverable. Learn how to properly redact a PDF — permanently removing sensitive data — plus what to redact and why.
Before you share a contract, medical record, or bank statement, you need to hide the sensitive bits — names, account numbers, addresses. But drawing a black box over text in most PDF viewers is a trap: the words are still there, sitting underneath the box, fully selectable and copyable. Real redaction removes the content, not just hides it.
This mistake has leaked confidential data in court filings, government reports, and corporate documents more times than you'd think. When you place a filled rectangle over text, you've only added a graphic on top — the original text layer is untouched. Anyone can select the “hidden” text, copy it out, or simply move the box. Proper redaction deletes the underlying words so there is nothing left to recover.
| Category | Examples | Why |
|---|---|---|
| Identifiers | SSN, passport, national ID, licence numbers | Directly enables identity theft |
| Financial | Card / account numbers, sort codes, balances | Enables fraud |
| Contact | Home address, personal phone, private email | Privacy & safety |
| Health / legal | Diagnoses, case details, third-party names | Regulated (HIPAA/GDPR) and confidential |
| Signatures | Handwritten signatures, initials | Can be lifted and reused |
Redacting the visible page isn't always enough — a PDF can carry hidden data in its metadata (author, software, edit history) and in attachments. After redacting, run the file through the PDF Sanitize tool to strip hidden metadata, or clear specific fields with the PDF Metadata Editor. Always open the final file and double-check before sending.
Never rely on a black box — it hides text on screen but leaves it fully recoverable in the file. Use true redaction to permanently delete the content, redact every category of sensitive data, and sanitize the metadata afterwards. The ToolsGravity PDF Redact tool removes the underlying data so what you hide stays hidden.