How to redact a PDF properly (and check that it worked)

Redacting a PDF means the details you hide are removed from the file, not just covered. Most leaks happen because those two things look identical on screen. Here's a way to do it properly, and a quick check you can run on any PDF before you send it.

1. Decide what the reader actually needs

Before you open any tool, write down what the recipient needs to see. A landlord checking your income needs the salary credits, not your account number. A visa office may need your name and address, but not your PAN. Everything else is a candidate for removal.

Common things to hide:

• National ID numbers, such as a Social Security, National Insurance or Aadhaar number
• Tax IDs and passport numbers
• Bank account numbers, IBANs and card numbers
• Phone numbers and email addresses
• Names and addresses of other people in the document
• File paths in headers or footers, like C:\Users\yourname\Clients\…

For a longer list by country and document, see what to redact, by document type.

2. Use a tool that removes content, not one that draws shapes

A black rectangle added with a drawing or annotation tool sits on top of the text. The text is still there. Use a tool that has a dedicated redact function and says it removes the content underneath.

If you use Adobe Acrobat Pro, Adobe's own guide says to leave the option to remove hidden information and metadata switched on when you apply redactions. If it's off, comments, hidden layers and revision history can stay in the file.

3. Don't forget scans

A scanned page is a picture, but many scanners and phone apps add an invisible text layer so the scan is searchable. Blacking out the picture doesn't touch that layer. Make sure your tool either removes it or rebuilds the page.

4. Save a new copy

Keep your original as it is and save the redacted version as a new file. You may need the original later, and you'll never accidentally send the unredacted one if the names are clearly different.

The two-minute check

Open the redacted copy and try to get the hidden details back. If you can, so can the person you send it to.

1. Select all and copy. Press Ctrl+A (⌘A on a Mac), copy, and paste into a plain text note. Read it. Nothing you hid should appear.
2. Search. Use the PDF viewer's search for the last four digits of an account or ID number you removed.
3. Check the properties. Open the document properties and look at the title, author and subject fields for names or folder paths.
4. Look at headers and footers. Zoom in on the very top and bottom of each page for printed file paths or reference numbers.

If any step turns something up, go back and redact again.

Where Ombly fits

Ombly is built so you don't have to remember all of this. It suggests what to hide, including card and account numbers, IBANs and national IDs, and rebuilds every page from pixels, so there's no text layer, metadata or old revision left in the copy. It's designed to run on your own computer. Join the waitlist to try it first.

For why a drawn box fails in the first place, read A black box is not a redaction.