Does a black box hide text in a PDF?

By Check Before Send · Updated

Usually not. A black rectangle drawn over text in a PDF only covers the words; the text can still be in the file, and a viewer can often select and copy it. Real redaction has to remove the content. The PDF standard says so, and so does Apple's description of its own redaction tool.

This guide shows what we saw in a test file with a black box over an email address, what the PDF standard requires of redaction, and what Apple documents for Preview on Mac.

What the standard says redaction must do

The PDF standard describes redaction in two steps. First, a person marks the content to be removed, and until the next step is done they can still see, move and change those marks. Second, a viewer applies the marks. After that, the standard says, the content in the marked area is removed, and a mark appears in its place to show the area was redacted.

It goes on: a program that supports redaction shall remove all traces of the specified content. If part of an image is inside a redaction region, that part of the image data shall be destroyed, and clipping or image masks shall not be used to hide it.

A rectangle that only covers text is the opposite of that. It hides content from the eye and leaves it in the file.

What Apple documents

Apple's guide to annotating a PDF in Preview describes a redaction tool. It says the tool selects text to remove it from view, that you can change it while you edit, and that once you close the document the redaction becomes permanent. The same page notes that if the PDF has a table of contents, entries that link to redacted text are not removed.

That last note is a good example of why redaction needs checking. Text can survive in places other than the one you covered.

What we tested

We made a small PDF with invented text: a line with an email address and a line of meeting notes. We drew a black rectangle over the email address after drawing the text, as a simple "cover it up" edit would do, and saved the file.

We then read the page text back with a PDF reader library. The email address was in the text, exactly as typed. We ran Check Before Send on the file: it listed the email address as a high-priority finding, which means the address was still in the file under the box. We let it make a copy and read the copy's page text: the address was gone, and the notes line was still there. We scanned the copy a second time, and no findings remained.

This is one small test file. Real PDFs from other programs may keep text in other forms, and a PDF made from a scanned picture holds pixels rather than text, so a rectangle over a picture is a different case that we did not test here.

What to do

  1. After you cover text, open the PDF and try to select and copy the area. If you can paste the words, they are still there.
  2. Use a tool whose job is redaction and that removes the content, not one that only draws a box.
  3. Check the copy you will send, not the original.

Check the PDF before you send it

Drop the PDF into Check Before Send. It lists what it finds, including text in the file that sits under a box, and you choose what to remove. It writes a new copy and runs a second scan on that copy. "Verified not found" means that second scan found nothing, not that the file is guaranteed clean. For pages that are pictures it uses text recognition, which can misread or miss words, so those pages are never reported as fully checked.

The file is read inside your browser and is not uploaded; the Trust Center explains how to confirm that. For other things a PDF can hold, see what hidden data a PDF can contain, or browse the other guides.

Sources