Why real redaction costs you the text layer

Redaction has an unusually harsh property: the failure mode is invisible. A badly redacted document looks exactly like a well redacted one. You find out it was wrong when someone else finds out.

The three approaches

Draw a black box. The text is underneath, in the content stream, selectable. This has caused public embarrassment to organisations with substantial legal departments, more than once, and it will keep doing so because the result looks correct on screen.

Edit the content stream. Genuinely remove the operators that draw the offending glyphs. This is the ideal — a fully searchable document with the sensitive parts absent — and it is delicate work. Text in PDF is drawn in runs, positioned with cumulative offsets; remove the wrong operator and the rest of the line shifts, or the font's encoding table no longer matches what is drawn. Getting it right for arbitrary real-world PDFs, including ones with unusual fonts and unusual producers, is a considerable undertaking.

Render the page to an image. Cover the area, flatten the page to pixels. Whatever was underneath is gone because nothing is underneath any more — the page is a photograph of itself.

What the third approach costs

It is not free, and the costs should be stated rather than buried:

• The redacted pages stop being searchable. Ctrl-F finds nothing on them.
• Screen readers cannot read them. This is an accessibility regression, and for some organisations it is a compliance problem in its own right.
• The file gets larger, sometimes considerably.
• Text quality depends on the rendering resolution. Too low and the page looks like a photocopy of a photocopy.

The right response is to limit the damage: flatten only the pages that actually contain redactions, and leave the rest of the document as real text. In a two-hundred-page production with redactions on six pages, that is the difference between losing 3% of your document's searchability and losing all of it.

What redaction does not do

It removes what is under the boxes you drew. It has no opinion about the same information appearing elsewhere.

If a name appears on pages 4, 40 and 180, and you redact page 4, the name is in the document twice. Nothing will tell you this unless you look. Before redacting, extract the text and search it — you are looking for every occurrence, and the text layer is the fastest way to find them.

Metadata is the other common leak. Author names, the original file path, the software used, and often a document title from an earlier draft all live in properties that no amount of redacting the pages will touch. Strip them separately, and check that the stripping covered the XMP packet as well as the basic fields, because many tools clear one and not the other.

A closing check

After redacting, extract the text from the finished file and search it for what you removed. If it comes back, the redaction did not work. If it comes back empty, you have done the one check that would have saved every organisation that has ever made this mistake in public.