That black box in your PDF is probably not a redaction: how to check in one command

You get a PDF back from legal, HR or a client portal. The account numbers are covered with neat black boxes, so it looks safe to forward. Very often it is not.

A black rectangle drawn on a page is just another shape on top of the text. The words underneath are still in the file, and anyone can get them back with copy and paste, a text extractor, or a search box.

Here is how to check a PDF in a few seconds, and what a real redaction has to remove.

The one-command check

If you have Poppler installed (it ships pdftotext), run:

pdftotext redacted.pdf - | grep -i "4111"

Replace 4111 with something you expect to be gone: a name, an ID number, part of an address. If the line comes back, the "redaction" only hid the text.

No command line? Open the PDF in a browser, press Ctrl+F (Cmd+F on a Mac) and search for the same word. If the viewer highlights a match under the black box, the text is still there.

Checking it in code

The same test in Node with pdfjs-dist:

import { getDocument } from "pdfjs-dist/legacy/build/pdf.mjs";

const pdf = await getDocument("redacted.pdf").promise;
for (let n = 1; n <= pdf.numPages; n++) {
  const page = await pdf.getPage(n);
  const { items } = await page.getTextContent();
  const text = items.map((i) => i.str).join(" ");
  if (/4111/.test(text)) console.log(`page ${n} still contains it`);
}

This is worth adding to any pipeline that publishes documents someone else redacted.

The places people forget

Even when the page text is really removed, the same words can survive somewhere else in the file:

• Comments and annotations. A reviewer's note that quotes the sentence you removed.
• Form fields. A filled field keeps its value even if you draw over it.
• Bookmarks and link targets. An outline entry named after the person or the case.
• Attachments. A spreadsheet embedded in the PDF with the full data.
• Metadata. The title, subject, author and keywords in the document properties, and the XMP block next to them.
• Hidden text on scans. A scanned page with OCR has an invisible text layer under the picture. A black box over the image hides the pixels, but the OCR words are still there for search and copy.

pdfinfo -meta file.pdf shows the metadata, and pdfdetach -list file.pdf lists attachments, so both are quick to check too.

What a real redaction does

A proper redaction tool removes the content, not just covers it:

1. It deletes the text and the parts of images inside the marked area from the page itself.
2. It searches the rest of the file (comments, fields, bookmarks, attachments, metadata) for the same words and removes them there too.
3. It draws the black box afterwards, as a sign that something was taken out.

After that, the check above should come back empty. If it does not, do not send the file.

We built the Redact PDF tool in KovaPDF to work this way. It removes the text, the image pixels and the OCR layer under each mark, along with comments and form values there, and it can also clear the document properties, attachments and bookmarks. It also tells you where a searched word still appears elsewhere in the file: https://www.kovapdf.com/redact-pdf

Whatever tool you use, run the one-command check before a redacted PDF leaves your hands. It takes five seconds and it catches the most common and most embarrassing mistake.