Is a Black Box Over Text in a PDF Real Redaction?

A black box drawn over text in a PDF is usually not a redaction. It hides the text from view but leaves it in the file, where anyone can select, copy or search it. A real redaction removes the underlying text, and you should confirm that by extracting the text from the saved file.

Why does text still show up under a black box?

A PDF stores text and shapes as separate objects. When you draw a rectangle over a name or number, the rectangle is a new object painted on top of the page. The text object underneath is untouched.

Anyone who opens the file can then press Ctrl+A, copy the page into a text editor, or search for the hidden word. The NSA's published redaction guidance, summarised by Nextgov, makes the same point: covering text is not enough, because the sensitive content has to be removed from the document, not just hidden.

How common is this problem?

More common than most people assume. In June 2026 Essex Software audited 63 publicly posted PDFs that were meant to be redacted. It found selectable text under the redaction rectangles in 11 of them (17%), with 558 characters recoverable. Among 26 US federal agency documents in the sample, 8 had the same flaw.

Treat these numbers with care. Essex sells redaction tools, the sample came from Google searches rather than a random draw, and the authors call 17% a floor. Even so, the direction is clear: visual redactions fail regularly in documents that real organisations have published.

What does the law expect from a redacted filing?

In US federal civil cases, Rule 5.2 of the Federal Rules of Civil Procedure limits what may appear in a public filing. You may show only the last four digits of a Social Security or taxpayer identification number, the year of a birth date, a minor's initials, and the last four digits of a financial account number. The filer carries the duty to redact, not the court clerk.

Rules differ by country, court and agency, so check the ones that apply to you. The principle is stable: if the information must not be public, it must not be recoverable from the file.

How do I redact a PDF so the text is really gone?

The goal is a file in which the covered text no longer exists. Here is a workable routine for a free, in-browser workflow:

1. Keep the original file untouched and work on a copy.
2. Open the copy in Redact PDF, which runs in your browser, and mark every name, number and address that must go.
3. Save the result under a new file name, such as contract-redacted.pdf.
4. Run the check described in the next section on the saved file, not on the one on your screen.
5. Only share the file once the check comes back clean.

Do not rely on a highlighter, a white rectangle, a text box with a black fill or a changed font colour. All of these only change how the page looks.

How can I check that a redaction worked?

Extract the text and look for what you meant to remove. A file that looks redacted but still yields the word in a text dump has failed.

1. Open the saved redacted file in PDF to Text.
2. Read the extracted text, or search it for each name, number and address you redacted.
3. If any of them appears, the redaction did not remove the text. Redo it from the original.
4. Also try selecting text with your mouse in a normal PDF viewer over the blacked-out areas.

If a page is a scan, the text extraction may find nothing at all, because the page is an image. That is a different situation: the content is only pixels, and the check is visual.

What else can leak besides the visible text?

Hidden data travels with the file even when the page content is clean. The Essex audit found at least one kind of metadata in 59 of the 63 files (94%). Common examples were an XMP stream (88.9%), a Producer field naming the software (77.8%), a document title (66.7%) and bookmarks (34.9%).

Bookmarks and titles can repeat the very words you redacted in the body. Author names, dates and the producing software can say who worked on a file and when. Before sending a sensitive PDF, open Clean Metadata to strip these fields from the saved copy.

Does my file leave my computer?

Not with the three tools above. The free tools on ilovspdfs process the file in your browser, in a Web Worker, and never upload it, so a sensitive document does not travel to a server while you redact it. They need no account and add no watermark. That matters when the file you are working on is the one you are trying to protect.

Key facts

• Essex Software's June 2026 audit found selectable text under redaction rectangles in 11 of 63 PDFs, or 17%.
• The same audit found 558 recoverable characters in those 11 files.
• 59 of the 63 audited files (94%) carried at least one form of leaked metadata.
• Federal Rule of Civil Procedure 5.2 allows only the last four digits of an SSN, taxpayer ID or account number in a public filing.
• Rule 5.2 also limits birth dates to the year and a minor's name to initials.
• The NSA's guidance states that sensitive content must be removed from a document, not merely covered.

Frequently asked questions

Is a black rectangle the same as redaction?

No. A rectangle is an extra shape placed over the page. The text under it stays in the file unless a redaction step deletes it.

Can I test a PDF without special software?

Yes. Open the file, try to select and copy the covered area, then paste into a text editor. Better still, run the saved file through a text extractor and search for the words you removed.

Does flattening a PDF fix a bad redaction?

Not by itself. Flattening merges annotations and form fields into the page, but a rectangle over live text is still just a rectangle. Always verify by extracting the text afterwards.

Do redacted PDFs need metadata cleaning too?

Often, yes. Titles, bookmarks, author fields and software names can reveal what the body hides. Clean the saved copy and re-check it.

Which identifiers does a US federal court filing have to shorten?

Under Rule 5.2, Social Security and taxpayer numbers, financial account numbers, birth dates and minors' names must be shortened to the last four digits, the year, or initials. Your court's local rules may add more.

Sources

• Essex Software: We audited 72 "redacted" PDFs
• Cornell Legal Information Institute: Federal Rule of Civil Procedure 5.2
• Nextgov: NSA issues redacting guidelines