Redact PDF

Find the words you want gone, cover them, and destroy the text sitting underneath.

Hybrid processingPDFWorkingNo account needed

What this tool does

Redact PDF runs two passes, and the order is the whole point. First pdftotext reports the position of every word on every page and your search terms are matched against those words, which turns each hit into a rectangle measured in points. Then pdftoppm renders every page as a picture at the resolution you choose, the black rectangles are painted onto those pictures, and img2pdf assembles them into a new document. The cover-up happens on an image, so at no stage does the output hold a box floating above live characters. A rectangle drawn in an editor is not redaction: the words stay in the file beneath it, and a copy-paste or a text extractor reads straight through. Here there is nothing left to read.

You supply the text to remove, one item per line. Matching is case-insensitive and works along a line, so a phrase spanning several words is found and every word the match touches is covered. Tick the regular expression box and each line becomes a pattern instead — an invalid one is refused by name rather than quietly skipped. Two presets can run alongside whatever you type: email addresses, and card and account numbers, which looks for runs of eleven to twenty-two digits with optional spaces or hyphens between them, so a sixteen-digit card written in groups is caught while a short reference number is left alone.

The price is the text layer, and it is worth understanding before you commit. Because every page comes back as a picture, the result is not searchable or selectable, and links, bookmarks, form fields and document metadata do not survive the rebuild. Small print at the default 150 dpi looks softer than the original, and the file usually grows rather than shrinks. There is no reverse operation, so keep the source document somewhere you trust before you replace it with the redacted copy.

The work happens on the processing service. Your PDF travels there over an encrypted connection to a machine running pdftotext, pdftoppm and img2pdf. A job that completes deletes the uploaded original immediately and keeps only the redacted copy until the retention window closes; a job that fails leaves its upload for the periodic sweep instead. The terms themselves are treated as the sensitive data they are: the job record stores a redacted marker in their place, and the real strings travel only in the queue payload the worker reads, which is cleared when the job ends. They are not written to the database, not logged, and not shown in the admin job list. Two limits then decide whether the tool can help you at all. A scan holds pixels rather than characters, so pdftotext finds nothing to match and PDF OCR has to come first. And if no term matches anywhere in the document, the job fails and lists what it searched for, rather than returning a file that redacted nothing.

How to use it

  1. Upload the document. One PDF per job, within the 200 MB ceiling and a 500-page limit. Adding several files only redacts the first, and a scanned document needs PDF OCR before there is any text to find.
  2. List the text to remove. One item per line — a name, an address, a reference number. Case is ignored, and a match that runs across several words blacks out all of them rather than part of a word.
  3. Or switch each line to a regular expression. Use this to catch a shape of thing instead of a fixed string, such as every reference that starts with the same prefix. A pattern that will not compile stops the job and is named. Every pattern runs case-insensitively; there is no switch that demands an exact case.
  4. Add a preset if one fits. Email addresses, card and account numbers, or both, applied on top of your own terms. The number preset only fires on runs of eleven to twenty-two digits.
  5. Choose the output quality. Between 72 and 300 dpi, 150 by default. Every page is rasterised at whatever you pick, so a higher figure keeps small print legible and makes the file heavier.

Processing & privacy

Hybrid processing. Smaller jobs can run locally; heavier jobs may use secure server processing.

Common use cases

Sending a contract outside the deal

Fee schedules, home addresses and bank details come out permanently, so the copy you hand over cannot be mined for the parts you meant to withhold.

Answering a disclosure or information request

The names and identifiers you are obliged to censor are destroyed rather than concealed, which is precisely the difference a recipient's text extractor will expose.

Publishing a document that quotes real records

An incident write-up or a case study can go out with every email address and account number stripped by preset in a single pass.

Sharing a system export with a supplier

Customer identifiers scattered through a long printed report are matched by pattern once, instead of being hunted page by page.

Questions

Can the removed text be recovered from the file?
No. Nothing is layered over anything: each page is turned into a picture, the boxes are painted onto that picture, and the document is rebuilt from the pictures alone. The original text layer is never carried across, so there is nothing underneath to select, copy or extract.
Is my file uploaded?
Yes. pdftotext, pdftoppm and img2pdf all run on the processing service, so the document goes there over an encrypted connection. A completed job removes the uploaded original at once and holds the redacted copy until its retention window expires. The terms you typed are not stored with the job: the record keeps a redacted marker, and the real strings reach the worker through the queue and go when the job does.
Why did it tell me nothing matched?
Either the words are not in the text layer, or they are not written the way you typed them. A scanned page carries pixels rather than characters, so run PDF OCR first. Matching also works within a line, so a phrase broken across a line break or split by a hyphen will not be found as one string. The error counts the terms off by position — term 1, term 2 — rather than repeating them, because that message is stored with the job and shown in the admin list, and echoing the words there would keep a plaintext copy of exactly what the tool was asked to destroy. Your own list is still in front of you on the page, in the order they count off.
Will the redacted file still be searchable?
No, and that is the trade you are making. Search, text selection, links, bookmarks and form fields all go with the text layer. If the finished document has to be searchable, run PDF OCR over the redacted copy — it can only read back what is still visible.
Can I black out an area rather than a word?
Not here. Redaction is driven entirely by text matching, so there is no rectangle to drag across a signature, a photograph or a logo. Anything that is not text pdftotext can read comes through untouched, which is worth checking before you send the result on.
Does it strip metadata as well?
Yes, as a consequence rather than a setting. The file is rebuilt from page images, so the title, author, producer and dates from the original do not carry over. When you want that clean-up without losing the text, Remove PDF Metadata is the tool for it.
How large a document can it take?
Up to 200 MB and 500 pages, and a job is stopped after two minutes. Rasterising is the slow half, so a long document at 300 dpi is the combination most likely to run out of time — lower the resolution or split the file first.

Related tools

  • Merge PDF — Combine several PDFs into one document in the order you choose.
  • Split PDF — Split one PDF into separate documents by page range.
  • Compress PDF — Reduce PDF file size while preserving the quality that matters.
  • PDF to JPG — Export every page of a PDF as a JPG image.
  • JPG to PDF — Turn one or many JPG photos into a single PDF.
  • Protect PDF — Add a password and set permissions on a PDF.