Published by IYIA on

The Hidden Risks of Free PDF Redaction Tools, and How to Check Any Redacted PDF

A redacted PDF can look perfect and still leak. Here is what goes wrong with free and "looks free" redaction tools, and a 60-second check you can run on any file before you send it.

Are free PDF redaction tools safe?

Some are. Many are not. And you cannot tell by looking at the result.

A page with black bars looks the same on screen whether the text underneath is gone or still sitting in the file. That is why redaction failures are so common: nobody sees them until someone else does.

"Free" also rarely means free. The price can be your files on someone else's server, an ad stamped on every page you send, or gaps in the detection that nobody tells you about.

This year a free, AI-powered PDF redaction app for Mac showed most of the problems below. They are not unique to that app. They are common patterns, so the useful question is not "which tool is safe" but "how do I check the file I am about to send".

What can go wrong with a free redaction tool

1. A watermark with someone else's name on your documents

The app stamped its own name and website on every page of the redacted PDF, and the option was on by default. Many people only notice after the file is gone.

The result: a client's contract or a patient letter goes out carrying another company's advertising, and the recipient learns which free tool handled their data. Before sending, look at the margins and footer of every exported page, and check the settings for any branding or watermark switch.

2. Scanned pages that are never read

Many tools only read PDFs that have a text layer. A scanned contract, a photographed ID or a faxed form is just a picture, so there is nothing for them to read.

The same app analyzed only pages with text. Scanned pages were skipped without a warning and exported as if they had been processed. You got a "done" message and a file with every name still visible. If your documents include scans, the tool needs OCR (optical character recognition), ideally running on your own computer.

3. Dense pages that are only partly scanned

AI models read text in chunks with a size limit. The app stopped reading each page after a fixed amount of text. On a bank statement, a spreadsheet export or a long table, everything after that point was never checked.

There was no warning and nothing in the export to show it. This is the hardest failure to spot, because the top of the page looks perfect.

4. The original page still inside the file

This is the worst one. For months, the app exported each page as a full image of the original, with the black boxes added on top as separate shapes. On screen it looked redacted. With ordinary PDF software, anyone could delete the boxes or pull out the page image and read everything.

It was fixed quietly in a later update. Files exported before the fix are still out there, and anyone who skipped the update kept producing them.

The rule: a redaction is only real if the content under the box is gone from the file. Hidden behind something is not gone.

5. AI that misses values without a label

AI detection is good at "Name: Jane Smith". It is much weaker at a bare number in a table cell, or a form field whose label sits two columns away.

The public model card of one widely used PII detection model reports much lower recall for values that have no label next to them. In practice, account numbers, dates of birth and reference codes inside tables and forms are the values most likely to slip through an AI-only tool.

6. A black box that only covers the text

This one is not limited to free tools. A black rectangle or a thick highlight drawn with the markup tools in Apple Preview, the drawing and comment tools in Adobe Acrobat, or a shape in Microsoft Word leaves the text exactly where it was. Select, copy, paste, and it is all there.

A box is not a redaction. See how to black out text in a PDF so it is really gone.

7. Metadata that survives

The pages can be clean while the file properties still carry the author's name, the original title (often the client's name) and the app that created the document. Our guide to removing PDF metadata on Mac lists every field to look at.

8. Uploading the file to someone else's server

Most online "free" redaction sites ask you to upload the document first. So the unredacted file, the one with all the sensitive data, sits on a server you know nothing about, under a privacy policy you probably did not read. For client, patient or employee files, that can be a bigger risk than a missed name.

Can a redacted PDF be recovered?

Yes, whenever the redaction only covers the content. If the text is still in the file (risk 6) or the original image is still under the boxes (risk 4), recovery takes seconds and no special skills.

If the content was truly removed, there is nothing left to recover. We go deeper in Can you unredact a PDF?

How to check if a PDF is properly redacted in 60 seconds

Run these checks on the exported file, the one you are about to send, not on your working copy. They work on any Mac, whatever tool did the redaction.

The 60-second redaction check

  1. Search for what you removed. Press Cmd+F and type a name or number you redacted. Any match means the text is still in the file.
  2. Select and copy under a box. Drag across a black bar, copy, and paste into TextEdit or Notes. If words appear, the box is only a cover.
  3. Make sure the page is not an image with boxes on top. Open the file in a PDF editor and try to drag or delete a box. If it moves and the original is underneath, the redaction failed. Extracting the images from the PDF works too: a clean copy of the original page is a red flag.
  4. Check the metadata. Select the file in Finder and choose File > Get Info, or press Cmd+I in Preview. Look at title, author and the app that created it.
  5. Check the scanned pages too. Scroll through every scanned or photographed page and confirm the sensitive parts are covered there as well.
  6. Look at the edges of every page. Margins and footers are where watermarks and stray text end up.
  7. Keep your tool updated. Some failures are fixed silently, so an old version can keep producing unsafe files.

If the file passes every check, the content is gone. If one check fails, do not send it.

How BlurData handles these points

We make BlurData, a Mac app for redacting PDFs and images, so here is plainly how it deals with each risk above:

  • On your Mac. Detection, OCR and export run on your Mac, and your documents never leave it. The app does go online for things like the preset catalog and update checks, but your files are not uploaded.
  • Text removed, not covered. The exported PDF has the sensitive text removed from the file, so Cmd+F and copy-paste find nothing.
  • Scanned pages included. Scans and photographed pages go through on-device OCR, so they are checked like every other page.
  • No watermark. Nothing is added to your pages: no logo, no link, no footer.
  • You review every detection. Every match is highlighted before export. You can remove it, hide a word everywhere it appears, or draw a box by hand. For values that follow a format, such as account or case numbers, document presets and your own patterns catch them with or without a label.
  • Keep-text export. With Save All as One PDF (keep text selection), the rest of the document stays searchable while the redacted parts are gone from the file.
  • Metadata. The original metadata (author, title, creator app) is not carried over to the exported file.

For the full walkthrough, see how to redact a PDF on Mac. If the document is going to ChatGPT or Claude rather than to a person, anonymizing documents for AI replaces names with consistent labels instead of black boxes. Comparing options? Our overview of Mac redaction tools puts them side by side.

Watch: redact a PDF on Mac, start to finish

How to redact a PDF on Mac so the text is really gone, step by step.

Frequently asked questions

Are free PDF redaction tools safe?

Some are, many are not, and you cannot tell by looking at the result. Watch for watermarks, skipped scanned pages, partly scanned pages, originals kept under removable boxes, and uploads to a server. Check every exported file before you send it.

How can I tell if a PDF was redacted properly?

Search for a removed name with Cmd+F, copy and paste across a black bar, try to move a box in a PDF editor, check the metadata and look at scanned pages. If any check shows the hidden content, do not send the file.

Can a redacted PDF be recovered?

Yes, when the redaction only covers the content. If the content was removed from the file, there is nothing left to recover.

Does drawing a black box in Preview, Acrobat or Word redact a PDF?

No. A drawn rectangle or highlight sits on top of the text, which stays in the file and can be selected, copied and searched.

Do online redaction tools upload my file?

Most web-based tools process the document on their servers, so the unredacted file is uploaded first. For sensitive documents, use a tool that works on your own computer.

Redact PDFs you can safely send

Text removed from the file, scanned pages included, no watermark. Your documents never leave your Mac. 14-day money-back guarantee.

Download BlurData for Mac

Related reading: Can you unredact a PDF? · Real-world redaction failures · Black out text in a PDF · Redact PDFs on Mac · Free redaction checker