How to redact a PDF safely

Remove the information, inspect the saved file and understand what your chosen method gives up. Updated 28 October 2026.

Free toolPDF RedactorMark private areas, review every page and save a fresh image-only PDF. Your document stays on your device.Redact your PDF

Use a tool that removes content

Use an explicit redaction tool, apply its changes and inspect the final file. A black rectangle in an annotation tool can leave the original words underneath.

You have two main choices: remove selected PDF content while retaining the rest, or rebuild every page as a masked image. The right choice depends on whether you need searchable text, accessibility and editable forms.

Method	What changes	Main caution
Annotation or black rectangle	Covers what you see.	Underlying text, images or previous revisions can remain. Do not treat an overlay as removal.
Content-preserving redaction	Removes selected page content while keeping other text and vector detail.	Use a trusted engine and its separate hidden-data or sanitisation controls. Inspect the output.
Fresh image-only PDF	Renders pages, replaces selected pixels, then builds a new PDF from those images.	Loses selectable text, tags, links and forms. The image still reveals anything you did not mask.

Make a working copy and decide what must go

Keep the original separately and redact a new copy. Read every page before marking. A repeated name, small footer or barcode can reveal the same detail in another form.

Identify the visible details you must remove, including images and form values.
Check repeated references across pages. Search helps with existing text but misses scans and split words.
Mark with enough margin to cover letter edges, accents and punctuation.
Apply the redactions, then review the actual exported file in another reader.

How floi creates the image-only copy

Floi renders every page and applies masks to its final pixel buffer. It then writes a fresh PDF containing those images.

No original PDF objects are copied. That removes the source text layer, attachments, metadata, interactive fields, links and previous PDF revisions. Form appearances are rendered before masking, so a form value cannot simply paint above a later mask.

Solid colours remove pixels. Blur and pixelation retain information.

Any fully opaque colour can replace private pixels. Black, white and custom colours use the same removal process.

Floi also offers adjustable blur and pixelation for visual editing. Those effects can leave words, faces or patterns readable or easy to infer. Use Solid colour when information must be removed.

Solid masks take priority over overlapping effects. Their source pixels are replaced before an effect can sample them. A copy containing visual effects needs a separate acknowledgement and saves as masked.pdf.

Image-only is a real loss.

All pages lose searchable text and accessibility tags, even pages without marks. A long document can become larger. Choose another method if your recipient needs accessible or selectable text.

Mark, rebuild and review

The PDF Redactor keeps editing and output review separate. Review output opens the rebuilt file, then asks you to inspect each page before saving.

Returning to Edit marks clears that approval. The source, search terms and regions remain in tab memory. Save the approved copy before closing the tab.

Resolution changes detail and memory use

Higher resolution preserves more visual detail, but increases pixel count. Doubling both page dimensions creates four times as many pixels.

Letter page at the selected resolution	Pixels	One RGBA pixel buffer
150 ppi	1,275 × 1,650	8,415,000 bytes
200 ppi	1,700 × 2,200	14,960,000 bytes
300 ppi	2,550 × 3,300	33,660,000 bytes

These are calculated values for an 8.5 × 11 inch page, using width × height × four bytes. They exclude renderer, encoder and output allocations. They are not measured browser memory totals.

Check the file you will actually share

Inspect both the visible pages and the document structure. Text extraction alone cannot prove a redaction worked.

Look closely

Open the saved PDF in a second reader. Zoom into every mask. Check letters at the edges, form answers and every other page.

Try to extract

Search and copy text from the saved file. An image-only output should contain no extractable text anywhere. This check does not inspect its pixels.

Inspect hidden data

Check attachments, document properties, comments, layers and fields. For a content-preserving redactor, use its sanitisation tools as well.

An independent command-line check

Poppler can inspect text, metadata, attachments and rendered pages. Run these commands against the new output, never against a similarly named original by accident.

pdftotext redacted.pdf -
pdfinfo redacted.pdf
pdfdetach -list redacted.pdf
pdftoppm -png -r 150 redacted.pdf check-page

For floi’s image-only output, expect no extracted text, no attachments, no forms and no original metadata. Open every generated PNG too. A secret can remain visible in pixels even when text extraction returns nothing.

Why form values need their own test

A PDF field can draw its visible value from a separate annotation appearance. It is possible to cover page text and still leave a form value visible above it.

The earlier floi feasibility experiment reproduced that failure with a synthetic form. It led to the current order: render all page appearances first, then replace the masked pixels. A fresh PDF or an empty text extraction result alone would not have caught it.

What the synthetic safety test checked

On 28 October 2026, an eight-page synthetic PDF was rebuilt at 150 ppi in Chrome 156 on an Apple M1 Max. Poppler 26.08.0 extracted the output images and text. A separate PDF parser inspected its objects.

Test	Observed result
11 regions across rotated and cropped pages	All 906,461 checked pixels had the expected solid black or white value, including the outward-rounded border.
Form value and annotation appearance	The marked appearances were covered in the final pixels. No interactive form objects remained.
Hidden text, layers and previous revision	No source objects or extractable text remained. The unmarked sixth page was also rebuilt.
Attachment, metadata and JavaScript	No attachment, original metadata stream or JavaScript remained. Only the fixed floi producer label was present.
Shared image, with one placement marked	The marked placement was covered. The unmarked placement remained visibly intact.
File size	The 6,594-byte synthetic source became a 176,546-byte image-only PDF. Rasterisation made this small text document larger.

Each final page was rendered and visually inspected too. These results cover this fixture and browser, not every PDF or platform. Byte counts can vary with source timestamps and encoders. The test does not assess whether someone has marked every detail they should remove.

Choose a desktop method when you need more

A trusted desktop redactor can be a better fit for long documents, preservation requirements or restricted work environments.

Option	When it helps	What to check
Adobe Acrobat redaction	Selected content removal with retained document features and hidden-data controls.	Mark, apply and use the relevant sanitisation options. Confirm your current plan includes redaction.
Preview on a Mac	A local workflow using the explicit Redact control on supported macOS versions.	Use Redaction Selection rather than a shape. Check the saved result and table of contents entries too.
Xodo	Text search, patterns and a content-preserving specialist engine.	Check current free limits, sanitisation behaviour and your organisation’s requirements.
Floi image-only redaction	Local area marking when a static visual copy is enough.	Accept the loss of text and tags, review every rebuilt page and independently inspect the saved copy.

Sources: Adobe’s sensitive-content removal instructions, Apple’s Preview annotation instructions and Xodo’s redaction tool. Features and plans can change. The competitor tests on 28 October 2026 confirmed Xodo’s repeated-text search and marked-item review, not its final exported file.

What a redaction cannot decide for you

A redactor cannot know which details you are allowed to disclose. It also cannot erase copies already shared elsewhere.

Do not use blur, a PDF password or a failed search as proof of removal. Apply the appropriate method, check the saved file and meet the recipient’s accessibility and disclosure requirements.