How to Redact a Document Before Sharing It (So the Data Stays Hidden)

Redacting means permanently removing information from a document before someone else sees it. The key word is permanently. A black box that only looks like it covers a number is not a redaction if the number can still be copied, searched, or revealed by moving the box.

The reliable approach for scanned paperwork is simple: cover the sensitive area with an opaque box, then make sure the box is burned into the page image and that no hidden text layer still contains the covered words. Below we cover what to hide, the mistakes that leak data anyway, and how to check your file before you send it.

What to redact (and what to leave)

Ask what the recipient actually needs. A landlord checking your income needs the salary figure, not your bank account number. A store returning an item needs the receipt total, not your card details. Common things worth hiding:

• Government ID numbers: Social Security, national insurance, tax and passport numbers.
• Financial details: full account, card and routing numbers, balances unrelated to the request, and individual transactions on a statement you are sharing for one purpose.
• The machine-readable zone on passports and ID cards. The two or three lines of letters and chevrons at the bottom repeat your name, document number and date of birth in a format any phone can read. Hiding the printed number but leaving these lines defeats the point.
• Barcodes and QR codes. They can encode the same data as the text around them, such as a booking reference or account ID.
• Signatures, when the recipient only needs to see that something was signed.
• Other people's details: family members on a utility bill, colleagues on an email printout, or patients on a medical form.
• Addresses, phone numbers and dates of birth when they are not needed.

Redaction mistakes that leak data anyway

Marker pen on paper

Felt-tip ink is rarely fully opaque. A camera or scanner, especially with contrast enhancement, can pick up the printed text underneath. Several passes help, but a digital redaction on the scan is far more reliable.

Boxes that sit on top of the page

Many PDF editors add rectangles as separate objects, or annotations, on top of the page. The original text or image is still underneath. Anyone can move the box, delete it, or simply select and copy the text below it. A redaction only counts when the covered pixels or characters are actually removed from the file.

Forgetting the hidden text layer

A "searchable" scanned PDF has an invisible layer of recognized text behind the page image. If you black out a number in the image but keep the old text layer, the number is still there. Search for it or select all and paste into a notes app, and it reappears. This is one of the most common real-world redaction failures.

Cropping instead of covering

Some apps keep the full original photo and only display a cropped version. Depending on how the file is exported, the cropped-off area can come back. If information is sensitive, cover it, do not just crop around it.

Low-contrast or blurred boxes

Blur, pixelation and semi-transparent highlighter effects can sometimes be partly reversed or simply read through, especially for short strings like numbers. Use a solid, fully opaque box.

Leaking it elsewhere

A perfect redaction does not help if the file is named Passport-123456789.pdf, or if you also attach the original by mistake. Check file names, email subjects and any other attachments.

A safe redaction workflow for scanned documents

1. Make a sharing copy. Keep your original somewhere private, and redact a version meant only for this recipient.
2. Scan cleanly first. A straight, well-lit scan makes it easier to place boxes accurately. Our scanning lighting tips help here.
3. Draw solid boxes over each item. Make each box slightly larger than the text it covers. Descenders on letters like g and y and the tops of capitals sometimes peek out from tight boxes.
4. Check every page. Account numbers often repeat in headers, footers and on the back page.
5. Flatten before export. Make sure the redaction becomes part of the page image, not an object on top of it.
6. Regenerate, do not reuse, the text layer. If you want the shared copy to be searchable, the OCR should be run again on the redacted pages so the covered words are never recognized in the first place.
7. Verify the exported file using the checks below, then send it.

How to check that a redaction really worked

Open the exported file, not the editor view, preferably in a different app from the one you used to redact it:

• Search test: search the PDF for the hidden number or a word you covered. It should not be found.
• Copy test: select all text on the page, copy it, and paste it into a blank note. Read through what comes out.
• Drag test: try to click on and move the black box. In a properly flattened file there is nothing to grab.
• Zoom test: zoom to 400% and look at the box edges for pieces of letters peeking out.

If the file fails any of these, do not send it. Fix the redaction and export again.

Black, white or colored boxes?

Black is the convention, and it tells the reader something was intentionally removed, which avoids confusion. White boxes make the page look clean but can mislead the reader into thinking nothing was there, which is a problem for official submissions. A colored box, such as red, can be useful when you want reviewers to notice exactly where something was taken out. Whatever color you choose, it must be fully opaque.

How to redact a scan in OnlyScans

OnlyScans has a redaction tool built into its page editor. It is part of the editing tools in Pro. On Android:

1. Open the document, find the page, and tap the Add text tool (the Tt icon).
2. Switch to the Redact tab and tap Add redaction. An opaque rectangle appears.
3. Drag it over the sensitive area and adjust its Width and Height. You can add as many boxes as you need and rotate them to match a tilted line.
4. Pick a color: black, dark gray, white or red.
5. Save, repeat for other pages, and export.

Under the hood, the app takes care of the failure modes above. Saved redactions are drawn into the page image itself, so the exported PDF or image has nothing on top to move. When you redact a page, the app also clears the document's stored recognized text and any business-card contact fields, because those could still contain the covered information. If you export a searchable PDF afterwards, the text layer is recognized from the redacted image, so covered words are not in it. For imported PDFs, the original text layer is not reused once a page has redactions.

The iPhone version has the same Redact mode with the same four colors, and it also bakes the boxes into the exported page. Both versions keep scans on your device, which matters for exactly the kind of documents people redact. If the recipient should not be able to open the file at all without a password, combine redaction with a password-protected PDF. For ID cards specifically, our sister site's ID card scanning guide covers capturing both sides.

Frequently asked questions

Can someone remove a black box from a PDF?

If the box is just an annotation on top of the page, yes, easily. If the box was flattened into the page image and the text layer was regenerated or removed, there is nothing underneath to recover.

Is blurring or pixelating as good as a black box?

No. Blur and pixelation keep some information about what was underneath, and short strings like numbers can sometimes be guessed back. Use a solid box.

Should I redact my signature?

If the recipient only needs proof that a document was signed, hiding or partly covering the signature is reasonable. If they need a signed original, for example for a contract, do not redact it, and share the file through a channel you trust.

Does redacting a scan remove the file's metadata?

Not necessarily. Redaction removes what you cover on the page. File names, document titles and other properties are separate, so check those too.