How to redact a PDF properly: a checklist

Start from a copy of the original, kept somewhere the recipient will never see. Then find every occurrence of what has to go before you start drawing. Names appear in headers and footers, in the running title, in tables, in footnotes and in the alt text of images. Account numbers are often repeated on every page. A text search with a regular expression — for an IBAN pattern, an email pattern, a date of birth — catches repetitions your eyes will skip.

Remember that search only reads the text layer. On a scanned page it finds nothing, and on a page where a word is split across two text runs it may miss a hit. Treat the search results as a floor, not a ceiling, and page through the whole document once with your own eyes after the boxes are placed.

For each page that carries a box, render the page to a bitmap, paint the box into the bitmap, and put the bitmap into the output document as an image. This is the step that actually destroys the content: the new page contains pixels and nothing else. 200 DPI is a sensible default; 300 DPI if the document will be printed or contains small type. A JPEG page image at 200 DPI is usually a few hundred kilobytes.

Decide what happens to the other pages. Keeping them as vector preserves sharpness and searchability, but it also preserves everything on them, including comments and hidden layers. Rasterising every page gives a uniform file that cannot carry anything but pixels. For sensitive releases, uniform is the safer choice; for a long report with one redacted appendix, keeping the rest as vector is reasonable if the vector pages are also cleaned of annotations.

A rasterised page has no text layer, which is the point. Check that your tool did not helpfully add one: some "print to PDF" and "optimise" functions run OCR automatically and write an invisible text layer over every image, and on a redacted page OCR reads only what is visible, so the layer is harmless — unless the OCR ran before the box was painted, in which case the hidden text is back. Order matters: paint first, OCR never, or OCR only on the final file.

If the recipient needs searchable text, run OCR as the very last step on the redacted output, and then re-check the result: the OCR layer should contain nothing from under the boxes because there is nothing there to read. Never run OCR on the original and then redact, and never redact a PDF that was OCR'd from a scan without rasterising the page again.

Open the document properties and blank the title, author, subject and keywords. Look for XMP metadata — it can hold the original file path, document history and the names of everyone who edited the file. Delete every attachment and embedded file. Remove bookmarks that quote redacted headings. Delete comments, stamps, highlights and other markup annotations: each is a separate object with its own text, and "Author" fields on comments carry names.

Form fields deserve a separate look. A field's value lives in the form dictionary, and the visible page only shows an appearance stream generated from it. Flattening the form draws the values onto the page and removes the fields, after which rasterising treats them like any other text. If you keep the form interactive, the values are still in the file, whether or not a box covers them on screen.

Many PDF editors save with incremental updates: the new objects are appended after the old file, and a new cross-reference table points at them. The old page objects are still physically present, and a reader that walks the previous cross-reference table sees the pre-redaction page. The cure is a full rewrite — "save as" into a new file, or building the output from scratch, so the file contains only one generation of objects.

Building a new document, rather than editing the old one, sidesteps this entirely. RedactDrop never writes into the original: it creates an empty PDF, adds the rasterised pages as images, copies over only the untouched pages you chose to keep, and writes fresh metadata. There is no earlier generation in the output because the output never had one.

The last step is the one people skip. Open the output and extract its text — with a PDF library, with a command-line tool such as pdftotext, or simply with select-all and paste. Search the extraction for the words you removed. List the annotations and check the document properties. If anything comes back, the redaction failed, and it is far better to learn that now than from a stranger.

RedactDrop runs this check for you after every apply: it re-opens the file it just wrote, extracts text from each rasterised page, counts annotations, checks every box against the text positions and reads the metadata, then shows the numbers. Treat that report the way you would treat your own check, and repeat it with a second tool if the stakes are high.