Is White-Out Enough to Hide Text in a PDF? How to Redact Safely

The short answer

Usually not. A white (or black) box drawn on top of a PDF hides the words from your eyes, but in most editors the words are still in the file underneath. Anyone who selects the area, copies it, searches the document or opens it in another program can often get them back.

To hide something for real, it has to be deleted from the file, not covered. That is what a redaction tool does. Our Edit PDF tool’s Whiteout goes part of the way: it deletes the text under the box when you download. It does not remove pictures under the box or the file’s hidden data, and it is not a certified redaction tool. The details are below, so you can decide whether it is enough for your document.

Why a box on top doesn’t hide anything

A PDF page is built in layers. The text is stored as real characters, and anything you draw later, such as a white rectangle, is added as one more layer on top. Covering the text changes what you see, not what is stored.

The US National Security Agency wrote a guide on exactly this problem, Redacting with Confidence (2005). It says that covering text, charts or tables with black rectangles works for printed paper but “is not effective, in general, for computer documents”, and that “the most common mistake is covering text with black.” The same applies to images: covering part of a picture with another graphic, or shrinking it until it is unreadable, “is generally not effective”.

The NSA’s rule of thumb is short: information “hidden or covered in a computer document can almost always be recovered”, so sensitive information “must be removed from the document through deletion.” Adobe gives the same warning on its own redaction page: making text white or covering it with a black marker is “unreliable and may not secure the information you need to keep private.”

The parts of a PDF you can’t see

Even if every visible word is dealt with, a PDF can carry information that never shows on the page. The NSA guide lists metadata and document properties as one of the three common mistakes, noting that this hidden information “is often as sensitive as the original document”. It also points out that converting a Word file to PDF “does not remove all metadata automatically”.

Things that can hide in a PDF include:

• Document properties, such as the title, author and the program that made the file.
• Comments and notes, which may sit in a side panel rather than on the page.
• Hidden layers and hidden text. Adobe’s redaction page describes a separate step to “find and remove content such as hidden text, metadata”, and recommends running it after the visual redaction, because comments and hidden layers can leak information.

What real redaction does

A redaction tool works in two steps. First it deletes the marked text and image areas from the page itself, so there is nothing left under the box to recover. Adobe describes Acrobat’s tool as one that “allows you to permanently remove text and graphics from your PDF document”. Second, a clean-up step (Adobe calls it Remove Hidden Information) strips metadata, comments and other content that is not on the page.

If the redaction is for a court filing, there are rules about what has to go. In US federal civil cases, Federal Rule of Civil Procedure 5.2 says that, unless the court orders otherwise, a filing may include only the last four digits of a Social Security number, taxpayer ID or financial account number, only the year of someone’s birth, and only a minor’s initials. The 2007 committee notes to the rule add that “the responsibility to redact filings rests with counsel and the party or nonparty making the filing”, so it pays to check the result yourself.

How to check a redacted PDF yourself

Open the saved copy, not the one still in your editor, and try to get the hidden words back:

1. Search for them. Use Find (Ctrl+F, or Cmd+F on a Mac) and type a word or number you meant to remove. If it is found, it is still there.
2. Select and copy. Drag across the blacked-out or whited-out area, or press Ctrl+A to select the whole page, copy, and paste into a plain text editor such as Notepad. Look for the removed words in the pasted text.
3. Open it somewhere else. Open the file in a second reader, such as your web browser and a desktop PDF app. A box that hides text in one program can behave differently in another.
4. Check the properties. In most PDF readers, File, then Properties (or Document Properties) shows the title, author and other fields. Make sure none of them gives away what you removed.
5. Look closely at scans. If a page is a scanned picture, searching and copying tell you nothing about the picture itself. A box over a scan only covers it, in any editor that doesn’t rebuild the image.

The NSA guide’s own final step is the same idea: review the output PDF for anything that was missed.

What our Whiteout tool actually does

Here is exactly what happens when you draw a Whiteout box in Edit PDF and download the file, so you can judge it against the steps above.

Removed: text that is part of the page. When you download, every letter whose centre falls inside a Whiteout box is deleted from the page’s content, so it can no longer be selected, copied or found by search. A letter that is only partly under the box, with its centre outside, stays. Draw the box a little larger than the words to be safe. This includes the invisible text layer that OCR adds to a scan, where it is stored in the page.

Only covered, not removed:

• Pictures and drawings under the box. They are hidden behind white but are still in the file. A scanned page is one big picture, so on a scan Whiteout hides the text from view but does not delete it from the image.
• Text stored inside an embedded graphic (a separate drawing object placed on the page) rather than in the page itself. It is covered, not deleted.
• Everything outside the page content: comments, filled form-field values, bookmarks and the document properties (title, author and so on) are left as they were. The editor does not strip metadata.

One more thing to know: when letters are deleted, the gap they leave is kept at the same width, so the rest of the line doesn’t shift. That keeps the layout intact, but the size of the gap can hint at how long the removed word was.

So Whiteout is a good fit for tidying a document you control, such as removing an old address from a form before you send it, where you have checked the result with the steps above. For legal filings, medical or financial records, anything on a scanned page, or anything where a leak would cause real harm, use a dedicated redaction tool that removes images and hidden data too, and still check the copy you send.

If your page is a scan

Because a scan is a picture, the only way to truly remove part of it is to change the picture’s pixels. A box drawn on top, in our editor or elsewhere, leaves the original image underneath. If you only have a scan and no redaction software, a reliable low-tech route is to work on paper, where the NSA guide says covering does work: black out a printed copy, then scan the marked-up page again, so the new file never contained the hidden words.

If you need to find out whether a page is a scan in the first place, try selecting a word on it. If nothing highlights, the page is an image. Our OCR PDF tool can add a searchable text layer to such pages, which also makes the search check above work on them.