Draw a black rectangle over a name in a PDF, export it, and the document looks redacted. Select the text underneath the rectangle, or search the file for that name, and in most editors it is still there — copyable, searchable, extractable. The box changed what the page displays. It did not change what the file contains.
This is not a hypothetical edge case. Box-over-text redaction failures are common enough to be a recognised category of disclosure incident, not a one-off mistake — court filings, government releases and corporate disclosures have all been "unredacted" this way, sometimes just by selecting the covered text and copying it out.
How to check any redacted PDF in thirty seconds
This works on a document from any source, not just PDF Vault's output.
- Open the file in any PDF viewer.
- Try to select the text under a black or white box, the way you would select a sentence to copy it.
- Try Ctrl/Cmd+F and search for a word you know was in the redacted section.
If either finds anything, the redaction is cosmetic. The content is still in the page's content stream; the box is just another object drawn on top of it.
Why this happens
A PDF page is not a picture — it is a set of instructions: draw this text at this position, draw this shape at that position. A redaction tool that "just draws a box" adds one more drawing instruction to the list. It does not delete the text instruction that was already there. Visually, the box sits on top. Structurally, both are still present, and any tool that reads the underlying content — not just renders it — sees the text plainly.
There are a few other places redacted text can hide even when the visible page itself is genuinely clean:
- Form field values. If the redacted area was a filled form field, the value lives in the document's form dictionary, separate from the page content, and survives page-level fixes.
- Tagged-PDF structure. Accessible ("tagged") PDFs carry an alternate text layer for screen readers that can repeat the page's text independently of what was drawn.
- Incremental save history. Some PDF editors append changes rather than rewriting the file, so an earlier, unredacted version of the page can still be recovered from the file's own revision history.
What real redaction requires
Correct redaction has to remove the content, not cover it. Concretely, that means:
- Rendering the page to a flat image with the redaction boxes burned in, so there is no longer a text object to select or extract from that page.
- Removing form field values on any redacted area, since covering a field visually does not touch its underlying value.
- Stripping the structure tree's alternate text, so tagged-PDF accessibility text cannot repeat the redacted content.
- Discarding objects that are no longer reachable from the document, so the original, unredacted content stream is not silently written out alongside the new one.
How PDF Vault does it
The Editor's redaction tool does exactly the four things above: pages with a redaction are rendered to pixels with the boxes burned in and the page object is rewritten in place (so bookmarks and links to it still resolve), form fields on that page are removed, the document's structure tree is dropped, and every object no longer reachable from the file's root is swept out before saving. Pages you did not redact are left completely untouched — their text stays selectable and searchable.
All of this runs in your browser. The document never reaches a server, which matters here specifically because redaction is usually applied to the most sensitive material in a file — the exact thing you would least want to hand to a third-party upload endpoint to have "removed."
The honest tradeoff
Turning a redacted page into an image is what makes the redaction real, and it has a real cost: the rest of that page's text — the parts you did not redact — also becomes part of the image and stops being selectable or searchable. Pages with no redactions on them are unaffected. If you need the surrounding text to stay searchable after redaction, that is a genuine limitation of doing this correctly, not an oversight, and it is the same tradeoff any tool doing real redaction faces.
Verify it yourself
After exporting a redacted PDF from anywhere, run the same check from the top of this post: try to select the covered text, and search for a word you know was there. Nothing should be selectable, and nothing should be found. That is the actual test of whether a document is safe to send to opposing counsel, a FOIA requester, or a journalist — not whether it looks redacted on screen.