A black rectangle drawn over a Social Security number looks redacted. It usually isn't. A surprising number of leaked "redacted" documents — including some embarrassing ones from government agencies and law firms — have had the hidden text recovered in seconds, just by selecting and copying it.
What actually happens when you draw a box
Most PDF editors and annotation tools add the black box as a separate object layered on top of the page — it's a shape sitting above the text, not a replacement for it. The underlying text is untouched: still present in the PDF's content stream, still selectable, still extractable by anyone who copies the text, removes the annotation layer, or runs the file through a basic text-extraction tool. Visually covered is not the same as gone.
What real redaction requires
Genuine redaction has to remove the underlying content, not obscure it. That means rasterizing the marked region — converting that part of the page into a flat image with the sensitive text baked out of existence — rather than layering a shape over live text. Once a region is rasterized, there's no text object left to select, copy, or extract; the pixels underneath the black box simply don't contain the original characters anymore.
A simple test before you send anything
Before sharing a document you believe is redacted, try selecting text over and around the black boxes, or paste the page into a plain text editor. If anything sensitive shows up, or if you can select through the box at all, it wasn't actually redacted — it was just covered.
Other places sensitive data hides beyond the visible text
Even a properly rasterized redaction can leave data exposed elsewhere in the same file. Metadata fields — author name, the software that created the document, sometimes a file path from the original author's computer — sit separately from the page content and aren't touched by redacting a region of text. Embedded thumbnail previews, generated automatically by some PDF writers, can retain an image of a page as it looked before redaction was applied. And revision history in a document that's been edited and re-saved multiple times can sometimes preserve earlier versions of a page inside the file's internal structure. A genuinely careful redaction pass checks all of these, not just the visible page content.
Real cases where this went wrong
This isn't a hypothetical risk — it's happened publicly, repeatedly, to organizations that should have known better. Government agencies have released “redacted” court filings and reports where the black boxes were simple overlay annotations, and journalists or researchers recovered the underlying text within minutes just by copying and pasting. Law firms have made the same mistake with settlement documents. The pattern is always the same: someone used a general-purpose PDF editor's highlight or shape tool, assumed visual coverage meant the data was gone, and never tested whether the text underneath could still be selected.
Redact PDF does this correctly, in your browser
DocZap's Redact PDF tool rasterizes the regions you mark rather than layering a shape over them, so the underlying text is genuinely destroyed — and the whole process runs locally, so the sensitive document never has to leave your device to be redacted. Pairing it with a metadata-removal pass covers the other common leak point, stripping author fields and document history that a content redaction alone wouldn't touch.
Try these DocZap tools