How to redact a PDF for legal discovery
A black rectangle isn't redaction if the text underneath is still selectable. Here's how to actually remove it.
Updated June 7, 2026
Do it now with AI Redact — free, no signup. Open →Why “black box” redaction gets firms sanctioned
The classic redaction failure is drawing a filled rectangle over sensitive text and calling it done. In a PDF, the rectangle is just one more drawing instruction painted on top of the page — the text it covers is still sitting in the content stream underneath. Opposing counsel (or a journalist, or anyone with pdftotext) can select straight through the box, copy the text, or extract it in seconds. Courts have sanctioned firms for exactly this.
Real redaction means the bytes are gone: removed from the page’s content stream so a reader, a copy-paste, or a script all come up empty.
What actually has to be removed
Redacting a document is more than the page you’re looking at. The same string can hide in several places:
- the content stream — what the page draws (the obvious one),
- the document metadata (
/Info: Title, Author, Subject, Keywords), - the XMP metadata stream embedded in the file,
- the tagged-text structure tree (
/ActualText), which mirrors the visible text for accessibility, - annotations — comments, form-field values, link targets.
A tool that only wipes the visible page leaves copies in the rest. Pditor removes the redacted string from every one of these, in each of its byte encodings, so strings on the output finds nothing.
Steps
- Open the document in AI Redact and let it load locally.
- Run the detector — it surfaces names, emails, phones, SSNs, and account numbers, grouped by type.
- Review the hits, switch off false positives, and select any extra text to remove.
- Apply — the text is deleted from the content stream and a black bar is stamped in place.
- Verify — try to select and copy the redacted region in the output. You should get nothing.
Before you produce
Always keep your own clean original. The produced copy is intentionally irreversible — once the text is removed there’s nothing to recover, which is exactly what a defensible production requires. Spot-check a few redactions with copy-paste, and you’re ready to hand it over.
Frequently asked questions
- Does a black box over text actually redact it?
- No. Drawing a black rectangle in most PDF editors leaves the original text in the content stream — anyone can select it, copy it, or extract it with a script. True redaction removes the text itself. Pditor deletes the text from the content stream and then stamps the black bar.
- Can redacted text still be recovered from PDF metadata?
- It can in tools that only wipe the visible page. A copy of the text often survives in the document's /Info dictionary, its XMP metadata, or the tagged-text structure tree. Pditor sweeps all of those for the redacted string after wiping the page.
- Is the redaction reversible?
- No — that's the point. The text is removed, not masked, so there's nothing to un-hide. Keep your own unredacted original if you need it; the produced copy is final.
- Is it free?
- Yes. Redaction is free, runs in your browser session, and needs no signup. Files auto-delete within an hour (24 hours on Pro).