How to Unredact a PDF: Why Redaction Fails [2026]
Copying and pasting text out from under a black bar in a "redacted" PDF isn't a hacking trick — it's a documented failure mode that has exposed sensitive information in government, legal, and corporate document releases for over a decade. Here's exactly why redaction breaks, how to check whether a PDF you've received is actually safe, and how to redact one properly.
When a large batch of government or legal documents gets released to the public with sensitive names, numbers, or passages "redacted," a familiar story tends to follow within hours: someone selects the black bar, copies it, pastes it into a blank document, and the supposedly hidden text appears in full. It happened with corporate litigation exhibits, it happened with a federal agency's operations manual, and it has happened repeatedly with large document releases tied to high-profile investigations. It isn't a hack. It's a well-documented flaw in how most PDF tools handle redaction — the black box is often just a shape drawn on top of the text, not a deletion of the text itself.
This guide explains exactly why that happens, how you can check whether a "redacted" PDF you've received is actually safe to treat as redacted, and — more importantly — how to redact a document correctly so this never happens with your own files. Along the way we'll also cover the visual equivalent of this problem: weak blur or pixelation on faces and license plates in photos and video, and how BGBlur's permanent face blur and license plate blurring tools avoid the same cosmetic-overlay mistake.
TL;DR: Why "Redacted" PDFs Get Unredacted
| Question | Answer |
|---|---|
| Can a black box over PDF text be removed? | Yes, if it's a drawn rectangle and not an actual deletion of the underlying text |
| Does copy-paste really reveal it? | Yes — select the blacked-out area, copy, paste into a plain text editor |
| Is a scanned document safe from this? | Not if it was OCR-processed; the invisible text layer behind the scan can still leak |
| How do I check my own redacted PDF? | Ctrl+A, copy, paste into Notepad, and search the file's metadata panel |
| What actually works? | Use a real redaction tool, flatten the file, then strip metadata before sharing |
| Does BGBlur redact PDFs? | No — BGBlur permanently blurs faces, plates, and text in photos and video; use a dedicated PDF redaction tool for documents, flattened the same way |
Why Does PDF Redaction Fail So Often?
PDF redaction fails because most people "redact" using a markup or drawing tool instead of an actual redaction feature, and a PDF is a layered file format where a drawn shape and the text underneath it are two entirely separate objects.
A PDF isn't a flat picture of a page — it's closer to a stack of instructions: text objects with exact character codes and coordinates, image objects, vector shapes, and metadata, all rendered together to look like one page. When someone opens a document in a free PDF editor or Acrobat's basic markup toolbar and draws a black rectangle over a sensitive line, that rectangle is added as its own object on top of the stack. The text object underneath is untouched. Visually, the page looks redacted. Structurally, nothing was removed.
Security researchers writing at the Argelius Labs redaction research page describe this as the single most common cause of redaction failures reported in journalism and legal-discovery incidents: the black box hides the text from view, not from the file.
The Copy-Paste Problem
The simplest recovery method requires no technical skill at all. Selecting the blacked-out region of text — sometimes as easy as pressing Ctrl+A (or Cmd+A) to select the entire page — and pasting it into Notepad, TextEdit, or a blank Word document pulls the original characters straight out, because the paste command reads the underlying text stream, not the pixels a human eye sees. This exact technique is how reporters have recovered supposedly confidential passages from corporate filings and, separately, how a federal agency's redacted operations manual was exposed after the file was posted to a public procurement site — copying it into another format revealed procedures the agency had intended to keep hidden, as Nextgov reported at the time.
The Hidden OCR Text Layer Problem
A second, less obvious failure mode affects scanned documents. When a paper document is scanned and run through OCR (optical character recognition) so it becomes searchable, the PDF stores two things: the visual scan image of the page, and an invisible text layer positioned behind it that mirrors what the OCR engine read. If a redactor draws a black box over the image of a sensitive line without also removing or reprocessing the invisible text layer underneath, the box hides what a human sees on screen — but the searchable, selectable, copyable text is still sitting there. BGBlur's guide on OCR text redaction in video covers the video-frame version of this same problem: text visible on screen (an ID card, a whiteboard, a document held up to camera) needs to be detected and permanently removed frame-by-frame, not just covered once.
Leftover Metadata and Revision History
Even when the visible text is genuinely gone, a document can still leak through what's left in its properties. Comments, tracked changes, author names, and prior versions of a file are sometimes preserved inside the PDF's metadata even after the visible redaction is applied, particularly when a document was exported from a word processor without clearing its revision history first. The NSA's own published guidance on redacting Microsoft Word and PDF documents specifically warns analysts that these formats retain "hidden metadata, graphics, and other information beyond visible text," and that redacting the visible page without cleaning the document properties leaves the sanitization incomplete.
Is This Something That Just Happened Once, or a Recurring Pattern?
Recurring — this is a well-documented pattern in large-scale document releases, not a one-off mistake. Government agencies, courts, and corporations have repeated the same black-box error across more than a decade of high-profile releases, because the underlying tooling problem (drawing over text instead of deleting it) hasn't changed even as document volumes have grown.
Large releases are especially prone to this failure for a structural reason: when hundreds or thousands of pages need redacting under deadline pressure, teams often standardize on whatever markup tool is fastest — a highlighter set to black, or a drawing tool's rectangle — rather than each reviewer manually confirming that a dedicated redaction feature was used and applied on every single page. One missed setting, one page processed with the wrong tool, and the entire release inherits that page's vulnerability. This is exactly why NSA guidance and courtroom e-discovery standards both treat verification as a mandatory final step, not an optional one — see the forensic de-pixelation guide for the visual-media equivalent of this same "check before you publish" discipline.
How Do I Check If a PDF Is Actually Redacted?
Run this five-step check on any PDF before you treat its redactions as trustworthy, whether you produced it or received it from someone else:
Step 1: Select and Copy Everything
Open the PDF, press Ctrl+A (Windows/Linux) or Cmd+A (Mac) to select all content, then copy it.
Step 2: Paste Into a Plain Text Editor
Paste the copied content into Notepad, TextEdit, or any bare text editor — never a word processor with formatting, which can visually re-hide oddities. If the supposedly redacted words, names, or numbers appear in the pasted text, the redaction failed.
Step 3: Use the PDF's Own Search Function
Open the find/search tool inside the PDF viewer and search for a term you'd expect to have been redacted. If the search locates and highlights it — even under a black box — the underlying text is still present.
Step 4: Check Document Properties and Metadata
Open the file properties or "Document Info" panel and review the author field, creation history, and any embedded comments or attachments for information that should have been scrubbed.
Step 5: Try a Dedicated Verification Tool
Redaction-focused checkers (such as the free scanners referenced by Redactr and Tamperlens) automate steps 1–4 and flag hidden text layers, leftover metadata, and un-flattened annotation objects in one pass — useful when you're checking dozens of files rather than one.
How Do I Redact a PDF Properly? (Step-by-Step)
Step 1: Use a Real Redaction Tool, Not a Drawing Tool
Choose the dedicated "Redact" feature in your PDF software (in Adobe Acrobat it's under Tools → Redact) rather than a highlighter, rectangle, or freehand markup tool. A true redaction feature marks the selected content for deletion, not just visual covering.
Step 2: Mark Every Instance, Including Repeats
Search the full document for every occurrence of the sensitive term — a name, an ID number, an address — since the same information often appears more than once across a long document, and one missed instance defeats the purpose of the rest.
Step 3: Apply the Redactions
Confirm and apply the marked redactions. This is the step that actually deletes the underlying text objects, not the step where you drew the marks — many redaction failures happen because someone marked the content correctly but never clicked "Apply."
Step 4: Flatten the Document
Flatten the PDF so it can no longer be edited or have its layers separated. Converting the final redacted page to a static image is considered the most reliable method of all, since a flattened image has no selectable text object left to extract — there's nothing left for a copy-paste or OCR-recovery attempt to find.
Step 5: Strip Metadata and Revision History
Clear the document properties (author, title, company), remove attachments, delete bookmarks and comments, and confirm tracked-change history isn't embedded from an earlier draft of the file.
Step 6: Re-Run the Verification Checklist
Before sharing or publishing, run the five-step check above on your own output file — the same way you'd check a document you received from someone else. Treat your own redaction as unverified until you've confirmed it the same way.
Does the Same "Cover It Up, Don't Remove It" Mistake Happen With Video and Photos?
Yes — visual media has a near-identical failure mode, and it's why BGBlur exists as a dedicated tool rather than a generic filter. A light blur, a small black bar, or low-resolution pixelation placed over a face or a license plate in a photo or video frame is the visual equivalent of a drawn PDF rectangle: it looks obscured to a casual viewer, but the underlying detail can sometimes be recovered with forensic sharpening, super-resolution, or de-pixelation tools, especially when the blur radius was small or the pixelation block size was large relative to the source resolution. Our guide on why weak blur fails under GDPR breaks down exactly how strong the distortion needs to be before it counts as irreversible under EU regulators' own technical standards.
✅ Motion-Tracked, Irreversible Face and Plate Blur
BGBlur applies AI-detected, motion-tracked blur across every frame of a video or every pixel region of a photo at a strength that resists forensic reversal — not a static box that can shift out of place or be undone. Detection runs in seconds per clip, tracks the subject continuously even as they move or turn, and the blur strength is calibrated well past the thresholds where sharpening tools stop recovering usable detail. Unlike a manually drawn box that a single missed frame can defeat, motion tracking re-detects the subject on every frame automatically.
✅ Client-Side Processing, No Permanent Copy Left Behind
Uploaded video is processed in your browser and deleted within 24 hours — there's no separate, unredacted "original" sitting on a server indefinitely the way an un-flattened PDF's hidden text layer sits inside the file itself. That mirrors the PDF best practice of working from a copy and discarding the source once the redacted export is finalized.
Step-by-Step: Permanently Blur Faces or Plates With BGBlur
Step 1: Upload Your Video or Photo
Go to bgblur.com and drag-drop your file (MP4, MOV, M4V for video, up to 4K; standard image formats for photos).
Step 2: Select Face, Plate, or Object Blur
Choose automatic face detection, license plate detection for dashcam or security footage, or draw a custom region for object or on-screen text.
Step 3: Export and Verify
Preview the export before downloading, then check it the same way you'd check a redacted PDF: zoom into the blurred region and confirm no recognizable detail survives at full resolution.
Comparison: Drawn Box vs. Permanent Redaction
| Method | What Happens Underneath | Recoverable? |
|---|---|---|
| Black rectangle drawn over PDF text | Text object untouched, only visually covered | Yes — copy-paste or search recovers it |
| OCR-scanned page, box drawn over image only | Invisible text layer untouched | Yes — text search or extraction recovers it |
| Redaction applied + flattened + metadata stripped | Text object deleted, page rendered as static image | No — nothing left to extract |
| Light blur/small pixelation over a face or plate | Underlying detail partially preserved in adjacent pixels | Sometimes — de-pixelation/sharpening can partially recover it |
| BGBlur motion-tracked blur, calibrated strength | Detail destroyed below forensic recovery threshold | No |
Who Actually Needs to Worry About This?
Legal and compliance teams preparing discovery documents or FOIA responses: a single un-flattened page in a thousand-page production can expose privileged or personal information, which is why e-discovery standards require the verification pass described above before filing.
Journalists and researchers publishing leaked or obtained documents: verifying a source document's redactions before republishing protects both the redacted party and, in some jurisdictions, the publisher from liability for republishing improperly hidden information.
Government agencies and public records officers releasing FOIA responses or public filings: the recurring pattern of black-box failures across agency releases is largely a training and tooling gap — using the dedicated redaction feature instead of a markup tool solves most of it.
Businesses sharing contracts, HR files, or medical records: the same tooling mistake exposes salary figures, medical details, or account numbers in ordinary business documents, not just government releases.
Anyone sharing video or photos with visible faces, plates, or documents on screen: the visual equivalent of this problem applies any time a face, license plate, or piece of on-screen text needs to be permanently unrecognizable rather than just visually softened.
Where BGBlur Fits — and Where It Doesn't
BGBlur is a video and photo privacy tool, not a PDF editor — it won't redact a text document for you, and dedicated PDF redaction software (with a flatten step) remains the right tool for that job. Where BGBlur fits is the visual-media side of the same problem: permanently, irreversibly blurring faces, license plates, and on-screen text in photos and video so they can't be reversed the same way a lazy PDF redaction can be undone. If your organization is standardizing a "redact everything before release" policy that covers documents and footage — body cam video, dashcam clips, security recordings — pair a proper PDF redaction workflow with BGBlur's motion-tracked blur so neither format is the weak link.
Frequently Asked Questions
Can you actually unredact a PDF? Yes, if the PDF was redacted improperly — meaning the sensitive text was only covered with a black rectangle, a highlight, or a sticky note rather than deleted from the underlying file. In that case the original text object is still embedded in the PDF's content stream, and selecting it (Ctrl+A, then copy), extracting the text layer with a script, or pasting into a plain text editor reveals it. A properly redacted PDF — one that was flattened to a static image or had the underlying text objects actually deleted — cannot be unredacted this way because the data is gone, not just hidden.
Why does copying and pasting reveal redacted text? Because a PDF is a layered document format, not a flat image. Tools like Adobe Acrobat's markup toolbar, or the annotation tools in many free PDF editors, draw a black rectangle as a separate object on top of the text layer by default rather than deleting the text underneath it. The rectangle blocks the text visually but the PDF's internal text stream — the part your browser or Ctrl+A selection reads — is untouched. Selecting the area and pasting it into Notepad or Word pulls the original characters straight out.
Is a redacted PDF with a hidden text layer from OCR still unsafe? Yes, and this is a separate failure mode from the black-box problem. When a scanned paper document is OCR-processed, the PDF stores an invisible, searchable text layer behind the visual scan image. If someone draws a black box over the image of the sensitive line without also stripping or re-processing the invisible OCR layer beneath it, that text is still present, selectable, and extractable, even though it looks correctly redacted to the eye.
How do I check if a PDF is properly redacted? Open the file, select all text with Ctrl+A (Cmd+A on Mac), copy it, and paste into a plain text editor like Notepad or TextEdit — if the supposedly redacted content appears in the paste, it wasn't removed. Also check the PDF's metadata and document properties panel for author names, tracked-change history, or embedded comments, and try the built-in search function to look for the redacted terms directly. None of these checks require special tools; they're the same steps a journalist or researcher uses to test a document before republishing it.
What's the correct way to redact a PDF permanently? Use a dedicated redaction tool (not a highlighter or a drawn box) that marks content for removal and then applies the redaction, which deletes the underlying text objects rather than covering them. After applying redactions, flatten the document so it can no longer be edited or have layers separated, then strip metadata, comments, and revision history from the file properties before sharing it. Government guidance from the NSA and multiple bar associations recommends converting the final redacted page to a flattened image as the most reliable method, since an image has no underlying selectable text to leak.
Do redaction failures only happen with government documents? No. The same black-box mistake has exposed information in corporate litigation filings, hospital records, university disciplinary reports, and press releases from private companies. Any organization using a basic PDF viewer's markup tools instead of a purpose-built redaction feature is exposed to it, because the failure is in the tool's default behavior, not the sensitivity of the document.
Can the same "cover it up, not remove it" mistake happen with photos and video? Yes — it's the visual equivalent of the same problem. A light blur, a small black bar, or a low-resolution pixelation over a face or license plate in a photo or video frame can often be reversed with de-pixelation or forensic sharpening tools, the same way a drawn box on a PDF can be undone. Permanent removal, not a cosmetic overlay, is what makes redaction actually hold in either format.
The Bottom Line
"Redacted" only means something if the underlying data is actually gone, not just covered. Drawing a black box over PDF text, or over a face in a video frame, is a cosmetic fix that copy-paste, text search, metadata inspection, or forensic sharpening can defeat — and that failure has repeated across more than a decade of government, legal, and corporate document releases for exactly the same reason each time: the wrong tool was used, or the right tool's final "apply and flatten" step was skipped. Checking your own redactions with the five-step verification pass above, and using a dedicated redaction or flattening tool instead of a markup pen, closes that gap for documents. For faces, license plates, and on-screen text in photos and video, BGBlur applies the same flatten-and-verify discipline with motion-tracked, forensic-strength blur that's calibrated to resist the video equivalent of a copy-paste recovery.