Drop the document in the emerald zone below, click a page, and drag a box over anything that must not survive. The drawing instructions that put those characters on the page are deleted from the file, and then a solid black box is drawn where they used to be. Select the text in the download and there is nothing there, because there is nothing there. Images under the box go too, and so do overlapping comments. The document never leaves this browser tab.
Your files are read by JavaScript running on your own machine. There is no upload, no queue, and no copy on our server to delete later.
Drag a card to reorder it, or use the arrows under each card. The order here is the order in the output. Each card is a preview of the finished page, so what you see is what the PDF will contain.
Esc close ← → move R rotate
Starting
This is your processor doing the work, so the time it takes depends on your machine and not on how many other people are on the site.
The redaction tool above works right now. The guide below explains the difference between redacting a document and drawing a rectangle on it, which is the difference behind almost every published document that turned out to be readable underneath - how the removal actually works, why a scan behaves completely differently from a digital document, and the checks worth running before anything leaves the building.
Two or three minutes for a short document. This PDF redaction tool runs inside the page you are reading, on your own processor. A document you are redacting is by definition one you do not want to upload anywhere, which is the entire reason this works the way it does.
Drop the PDF into the zone above. Every page appears as a tile, and the badge on each one counts the areas you have marked on it, so a forty page document tells you at a glance which pages you have been through.
Click a page to open it full size and drag a box over anything that must not survive. Cover the whole word, including the tail of a "y" and the dot of an "i" - a box that clips a descender leaves a fragment behind and the engine will honestly report that it removed less than you intended.
A name in a footer, an account number in a header, a reviewer comment attached to page nine. Use the tile badges to track progress. Leave the metadata switch on unless you have a reason not to: the author name, the originating username and the internal file path travel in every PDF and none of it is visible on the page.
Press Redact PDF. The result screen states how many characters were deleted from the page content, how many images were removed and how many annotations went with them. If it says no text was found under the boxes, the page is a scan - read the section on that below before you send it anywhere.
There is only one drawing tool on this page and it is the redaction box. Every other tool in the suite offers a plain cover-up rectangle; this one deliberately does not, because two rectangles that look identical on screen and behave completely differently is exactly how a document gets published with the secret still in it.
This is the single most important thing on this page. A black rectangle drawn over a paragraph in a PDF hides nothing. The words are still in the file, exactly where they were, in the same order, fully selectable. The rectangle is one more drawing instruction that happens to run after them.
Three keystrokes reverse it. Open the document, press Ctrl+A to select everything, Ctrl+C to copy, and paste into a text editor. Everything that was ever on those pages appears, including every character under every box. No tools, no expertise, no effort. Anybody who has ever tried to copy a paragraph out of a PDF already knows how to do this by accident.
This failure is documented, repeated and public. Governments, courts, law firms, banks and newspapers have all published documents with black boxes over names that anybody could read within minutes of the file going online. It keeps happening to organizations with large legal departments, because the software made "draw a black rectangle" and "delete the text" look like the same action.
| What was done | Why it fails |
|---|---|
| A black rectangle drawn in a PDF editor or with an annotation tool | The text is untouched underneath. Select all, copy, paste. Or delete the annotation, which in many readers is a right click. |
| A black highlight applied in Word before exporting to PDF | Highlighting sets a background color on text that is still text. The export faithfully preserves both. |
| The text recolored to white, or moved off the page | Still in the content stream, still extractable, and it reappears the moment anybody selects it or changes the background. |
What all three share is that they change how the page looks and leave what the page contains alone. Redaction has to do the opposite: change what it contains, and then make it look changed as well.
A PDF page is a program. A word processor stores a document and a camera stores a picture, but a PDF page stores a sequence of instructions in a small drawing language: set this font, move here, show these characters, move there, show these. Redaction means opening that program and deleting instructions from it.
Step six is subtle and it matters enormously. Pointing the page at a new content stream and leaving the original object registered writes both into the saved file. The document then looks redacted, opens redacted and prints redacted, and still contains every deleted sentence as an unreferenced object that any text extractor pulls straight back out. That is the same failure as the black rectangle, arrived at from the other direction, and it is the kind of bug that ships because everything on screen looks correct.
Occasionally a document uses a font that declares no width table and names a face we have no metrics for. Without exact widths, splitting a line and repositioning what is left would guess, and a guess would shift surviving text. So the engine removes the whole run instead and tells you it did. More is deleted than you marked, never less, and it is reported on the result screen rather than left for you to discover. On a tool whose failure mode is "the secret is still in the file", erring in that direction is the only defensible choice.
If the page is a photograph or a scan, there is no text to delete. The whole page is one image, and the "words" are patterns of pixels. In that case the black box genuinely is the redaction, and the result screen says so in exactly those words rather than letting you assume otherwise.
That leaves one real hazard, and it is worth understanding because it is not obvious.
A black box drawn over a scan sits on top of the picture rather than inside it. The page renders black, and text recognition run over the rendered page finds nothing, so on screen and in a search the redaction looks complete. The original pixels are still in the embedded image file underneath. Software that pulls the image out of the PDF instead of rendering the page recovers the whole thing.
The engine handles this the honest way: if an image intersects a redaction box, the entire image is removed from the file, not cropped or covered. On a scanned page that means the whole page image goes and the black box is what remains. That is drastic, and it is correct - a cropped copy still contains the original pixels in most encodings, and a covered one certainly does.
Which gives a clear rule for scans:
The last one catches people out constantly. A scanned contract, made searchable so it can be filed properly, then redacted - and the redaction removes the invisible text correctly but the workflow order meant there was a moment where a fully searchable copy of everything existed. Redact first.
Every PDF carries a block of information about itself that never appears on any page. Open the document properties of almost any file you have received and you will find some of it. This is where a surprising number of disclosures actually come from.
The metadata switch in the rail is on by default and clears all of it. Leave it on. There is essentially never a reason for a document leaving your organization to advertise the name of the person who typed it and the internal path it was saved to.
Annotations are the other invisible layer. A comment bubble whose text contains the very sentence you are removing is a spectacular way to undo the exercise, and comments are collapsed by default in most readers so nobody notices they are there. Any annotation overlapping a redaction box is deleted with it, contents and all.
Two minutes, on the downloaded file rather than on the preview, and it catches every ordinary failure. Do this every time on anything that matters.
The copy and paste test is the one that matters. It takes ten seconds, it needs no tools, and it is exactly what a journalist, an opposing counsel or a curious recipient will do first. If your redaction survives it, it survives the overwhelming majority of what anybody will actually try.
Consider the shape of an upload based redaction service. You have a document containing something that must not be seen. To remove it, you send the document - with the sensitive material still in it - across the internet to a machine you do not control, where it is written to a disk while a queue processes it.
For every other kind of tool that is a reasonable trade. For this one it is close to absurd. The whole point of the operation is that certain information must not reach anybody else, and the first step is transmitting it to a stranger.
Verify it in ten seconds. Load this page, turn off your network, and redact a document. It works end to end. That single test settles the question in a way no privacy policy can, and no upload based competitor can pass it.
Every tool in this suite carries this section. On this one it is the most important section on the page, because the consequences of a wrong assumption are worse here than anywhere else in the suite.
And the honest framing of all of it: this tool removes what you tell it to remove, correctly and permanently. Deciding what has to go is the part that needs a human who understands the document, and no software changes that.
Order matters here more than on any other tool in the suite, because several ordinary operations will reintroduce exactly what you just removed.
| The situation | The order that works |
|---|---|
| A scanned contract that has to be searchable and redacted | Redact first, then run OCR. Recognition writes a selectable text layer, and doing it first means creating a searchable copy of the very words you are about to remove. |
| A document that also needs a password | Redact, verify with copy and paste, then encrypt. A password over an unredacted document protects the file, never the information. |
| Several documents going out together | Redact each one and verify each one, then merge. Merging first makes the review harder and the mistakes easier. |
| Only some pages are being disclosed | Extract the pages that are going out, then redact only those. A page that is not in the file cannot leak from it. |
| A document that has to be signed as well | Redact first, then sign. Redacting after signing changes the bytes and invalidates the signature, which is the tamper detection doing its job. |
The rule underneath every row: redact as early as possible and verify immediately afterwards. Every step you take on an unredacted document is another copy of it in another place. The rest of the PDF suite runs on the same architecture as this page - nothing uploaded, nothing stored, everything on your own machine.
Drop the file into the zone at the top of this page, click a page, and drag a box over the text. The instructions that draw those characters are deleted from the page content and a black box is drawn where they were. Select the text in the download and there is nothing under the box, because there is nothing there. No account is needed for a first run and nothing is uploaded.
No, and this is the most consequential misunderstanding in the whole format. A black rectangle is one more drawing instruction; the text underneath is untouched and fully selectable. Select all, copy, paste into a text editor and everything appears. Organizations with large legal departments have published documents this way and had them read within minutes of the file going online. This tool deletes the characters from the page content stream instead, so there is nothing left under the box to extract.
Open the downloaded file, press Ctrl+A then Ctrl+C, and paste into a plain text editor. Nothing you redacted should appear. Then search the document for the words you removed and confirm zero results, and check File then Properties for leftover metadata. It takes ten seconds and it is exactly what any recipient will try first.
Yes, but differently, and the tool tells you which case you are in. A scan has no text to delete - the words are pixels in an image. Any image intersecting a redaction box is removed from the file entirely rather than cropped or covered, because a covered image still contains the original pixels. The result screen reports whether text was found or not.
After. Always after. Optical character recognition writes an invisible, fully selectable text layer over the image, and running it first means creating a searchable copy of the exact words you are about to remove. Redact the scan, verify it, then make it searchable.
No. The file is read from your disk by the browser, rewritten in memory, and written back to your downloads folder. For this tool in particular that is the whole point: uploading a document to remove something sensitive from it means transmitting the sensitive material first. Verify by disconnecting from the internet after this page loads and redacting anyway.
No. A partially redacted line is rewritten as a kerned array whose adjustment equals exactly the advance of the removed characters, taken from the font's own width table - the same numbers the reader uses to lay the line out. Everything after the gap stays where it was to the thousandth of an em.
Yes. Any annotation overlapping a redaction box is deleted with its contents. This matters because comments are collapsed by default in most readers, so a reviewer note quoting the sentence you are removing is easy to miss entirely and trivially readable by anybody who opens the comment panel.
Yes, by default. The author name, the title, the creating software, the producer and the timestamps are cleared. This is a real source of disclosures - the title field is frequently the original file name, which frequently contains a client name or a case number, and none of it appears on any page.
No, deliberately. You mark what goes. A tool that offered to find everything would be trusted to have found everything, and the one it missed would be the one that mattered. Deciding what is sensitive needs somebody who understands the document.
The whole text run is removed instead of being split, and the result screen says how many runs that happened to. More is deleted than you marked, never less. On a tool whose failure mode is "the secret is still in the file", that is the only defensible direction to err in.
One at a time, because every redaction is a specific human judgment about a specific page. If several documents are going out together, redact and verify each one individually and then merge the results - merging first makes the review harder and the mistakes easier.
No. The output is your document with the marked content removed and a black box drawn where it was, and nothing else. No stamps, no trial banners, no attribution link.
Not for a first run. A visitor who is not signed in gets one operation every twelve hours, counted by network fingerprinting. A free CartHacker account raises that to two in the same twelve hour window, and CartHacker Premium removes the limit. The processing is identical and local at every tier - the document is never uploaded regardless of what you have paid.
All of these run the same way: your file is read by JavaScript on your own machine, the work happens on your processor, and the result is handed back to you as a download that never existed anywhere else.
Find the apps that slow your store down, by name and in milliseconds, then answer shoppers' doubts with trust badges under Add to cart. Both are free, with no card and no access to your store admin.
Paste any page and get its three Core Web Vitals, the apps costing time, like Klaviyo or Judge.me, and the Shopify or WooCommerce fix.
Show the promises that settle doubts, from free shipping to a money-back guarantee, right under the Add to cart button. One line in your theme.
Change the link after printing and count the scans. 5 tracked codes on a free account, static codes unlimited.
Anonymous visitors get one operation per 12 hours, per network address. That is not a sales tactic, it is the only lever we have: this tool runs on your processor, not ours, so the run itself earns us nothing. An account tells us who you are, and the ceiling goes up the moment you have one. Your allowance resets in 12 h.
No credit card, no trial period, no sales call. Join with Google, GitHub, Facebook or email.
Free accounts get two operations per 12 hours, and yours reset in 12 h. Waiting costs you nothing and is a completely reasonable choice. If PDF work is a weekly job rather than a one-off, the counter is the wrong tool for you and Premium takes it off the page.
Cancel anytime. Everything you have already produced stays yours either way.