How to Hide Data on a Scanned PDF Without a Trace

A scan is a picture, and painting over a number in a viewer means laying a layer on top that comes off with one click. The editor does it differently: it redraws the page with a redaction area from scratch, with the area already painted, and no pixels or text layer remain under it. The other pages are left alone. File properties, attachments and bookmarks are not cleared and need a separate check.

Your landlord asks for a copy of your passport, the bank wants a scan of a contract, and the contract contains a colleague's salary and somebody else's signature. Sending it as it is feels wrong, so the obvious move is to open the PDF in a viewer, draw a black rectangle over the number and save. It looks solid. In reality the recipient selects the rectangle, presses Delete and sees the whole number.

With scans the mistake is especially common, because a scan feels like "just a picture" nobody can tamper with. That holds until the picture becomes part of a PDF: there anything can be laid on top, and whatever is laid on top stays a separate layer. The Redact PDF tool works differently: it redraws the page that carries a redaction area from scratch. Here is what happens when it does, where data hides on scans and what to check before you press Send.

Why a rectangle in a viewer hides nothing

A PDF is built in layers. At the bottom sits the page content: for a scan that is one large picture, for a word-processor document it is text and graphics. On top sit the annotations: comments, highlights, stamps and the very shapes that viewers' "Markup" and "Shape" tools draw. An annotation knows its position and colour but does not touch the content beneath it.

That gives three ways to lift such a rectangle, none needing special software: select and delete it, remove it from the comments panel, or open the file in an editor that lists annotations. Some viewers bake annotations into the page on "Print to PDF", and then the rectangle stays put, but the number under it is still in the file, in the original picture. The data is not deleted, only covered.

A scan adds one more layer that is easy to forget: if the file has been through text recognition, an invisible text layer with the same letters sits under the picture. The rectangle does not touch that either, and the passport number turns up in a plain document search.

What the editor does to a page with a redaction area

The tool page opens the browser PDF editor in a mode where the redaction area is the only tool left. You add one or more areas, stretch them over the right spots and press "Apply changes". Then the main thing happens.

A page with at least one redaction area is not edited but redrawn from scratch as a picture: the page is rendered in full, the area is painted over on the resulting image, and that image replaces the page in the output file. Nothing is left under the area: not the pixels of the original scan, not the text layer, not the recognised text. There is nothing to restore them from: the new file does not contain them.

This has a price, and you should know it in advance. Text on a redrawn page can no longer be selected or found by search, even outside the area: the whole page has become a picture. The redraw is done at around 150 dots per inch, below a typical 300 scan: enough for screen reading and online portals, but in professional print that page will look softer than the rest. Links the area did not cover are kept. Notes stay notes. The remaining pages are carried into the output file as they were.

For scans the price is worth paying: they either have no text layer or only a supporting one, and turning the page into a picture takes nothing essential away.

Blur, pixelation and cropping: what does not count as hiding

Besides the rectangle on top, three other techniques are common, and each leaves the data in the file.

Blur and pixelation. They do not remove a fragment, they degrade it. For short text with a known structure, such as a passport number or an amount, a blurred fragment can be brute-forced: take every possible value, blur it the same way and compare. For digits this is quick, and such cases have been dissected publicly more than once. That is why the redaction area in the editor is solid only: white, black or any other colour, with no blur. A solid colour gives nothing to compare against.

Cropping the page. It changes the visible area of the sheet, not the content: everything outside the frame is still in the file and comes back when any editor resets the crop. If a margin with notes needs to go, paint it over rather than crop it.

Lowering the resolution. A heavily compressed scan is harder to read, but the digits are still legible when zoomed in, and for text recognition that quality is usually enough. This is not protection, only an inconvenience for the recipient.

All three techniques share one trait: they change how a fragment looks, not whether it is in the file. Redaction in the editor takes it out.

Passport and contract copies: what to hide and what the recipient needs

Deleting everything in sight is a bad idea: a copy with the fields the recipient needs for verification painted over will come back with a request for a proper one. Decide in advance exactly what the recipient requires and hide the rest.

For a passport copy requested for an identity check, the surname, given names, date of birth and photograph are usually needed, while the passport number is not always: ask the recipient. The page with the registered address is only needed where the address is verified. The holder's signature on a copy is almost never needed, yet it is what gets reproduced most often.

For a contract, the recipient usually cares about the parties, the subject and the dates, not the amounts in other clauses or the other party's bank details. If a bank asks for a tenancy agreement as proof of address, the landlord's passport details are of no use to it.

For a bank statement or a proof of income, hide the account number and the transactions unrelated to the request, but leave the totals and the organisation's details: without them the document cannot be verified.

Once you know what stays, go through the document once with exactly that list. That way you neither delete too much nor miss a fragment that did not fit your first idea of "the important data".

Where data hides on scans

The data the exercise is about is usually in plain sight: the document number, the amount, the surname. It is the other things that get missed.

Bleed-through from the back. On thin paper the mirrored text of the reverse shows through, and on a scan it can be read when zoomed in. If the back carries data, it is visible on the front.

Signatures and stamps. A signature is personal data in itself. A stamp carries the organisation's name, its tax number, sometimes its address.

Handwritten notes in the margins: phone numbers, instructions, dates. Incoming-mail stamps with a case number.

Barcodes and QR codes. They may encode the same document number or a link to a personal page. A code cannot be read by eye, but a phone can.

Headers and footers. A surname or a contract number in the page header repeats on every page, and an area is needed on every page.

Before you begin, page through the whole document zoomed in, not only the pages where you expect data.

How to find every occurrence in a long scan

The redaction tool page has document search but no recognition button: on a scan without a text layer the search has nothing to look through, and you have to look for mentions by eye. For a two-page passport that is fine. For a forty-page contract with the surname in every clause you need a different route.

Open the same file in the full Edit PDF editor, where text recognition is added to the redaction area and the search. Press "Recognise text (OCR)" for the pages that have no text, then type the surname into "Search in document". The editor lists every match by page. Add an area on each page found, stretch it over the match and apply the changes.

The recognised layer goes into the output file too, but not everywhere: pages without areas keep it, while pages with areas are redrawn as pictures and lose it with everything else. Search only looks through text that exists, so on unrecognised pages it finds nothing. If the document already has a text layer, recognition is not needed and search works straight away, on the redaction tool page as well.

Recognition counts against the daily operation limit, just like the separate OCR PDF tool. When you pick pages, the editor shows which ones will be recognised and tells you if the limit is used up.

Step by step

1. Open Redact PDF and upload the scan. The editor cannot read a password-protected file: it will offer to remove the password with Unlock PDF and open the unlocked file. 2. Pick the page and press "Add redaction". A rectangle appears on the page, white by default. Drag it into place and stretch it with a few millimetres to spare: letter edges on a scan are soft, and an area that fits too tightly leaves readable tails. 3. If needed, change the area's colour in the "Color" field of the right-hand panel. White looks like clean paper on a scan; black tells the recipient plainly that something has been removed here. 4. Repeat for every fragment and every page. One area covers one rectangle; data scattered across a page needs several. 5. Press "Apply changes" and download the result. The original file is not changed.

If a whole page needs hiding, skip the area: it is simpler to remove the page entirely with Remove pages.

How to check the result

The check takes a minute and protects you from the most expensive mistake.

Open the downloaded file and try to select text on the page where the area was. Nothing should select: the page has become a picture. If text does select, you are looking at the wrong file, most likely the original.

Zoom in on the edges of every area. Letter tails sticking out from under the rectangle mean the area was too narrow: go back, stretch it and apply the changes again.

Run a document search for the hidden values: the surname, the number, the amount. On pages with areas it finds nothing: the text is gone. If it does find something, the same value sits on a page that had no area.

Page through everything, including pages where no data was expected. Headers and stamps like to repeat.

What stays in the file after redaction

The editor redraws pages but does not clean the document as a whole, and says so when you add an area. Three places deserve a separate check.

Document properties. Author, title, subject and keywords live in the metadata and are visible in any viewer before the file is opened. A phone scan often carries the owner's name in the author field. These fields are cleared by the Set PDF metadata tool: it has a "Clear existing metadata" toggle that wipes every existing value instead of only overwriting the ones you fill in.

Attachments. A PDF can carry other files inside it, and the editor leaves them alone. If the document came from someone else, check the attachments panel in your viewer.

Bookmarks. The table of contents stays as it was, section titles included. Usually harmless, but if a section was named after a person, the name stays in the bookmarks.

And one last thing, outside the file: its name. "Passport_Smith.pdf" tells the story before the file is opened. Rename it before sending.

What happens to the file's size and look

A redrawn page lives in the file as a single picture, and the document's size can move either way. A word-processor page will almost certainly get heavier: text and vector graphics weigh less than a picture of them. For a scan the outcome depends on how the original was compressed and cannot be predicted: it is simpler to look at the size of the finished file.

A redrawn page differs from its neighbours only under strong magnification: the letter edges are softer. At normal zoom and on an office printer the difference is invisible. If the file needs compressing for sending, do it after redaction, not before: compressing the original scan first only degrades the picture the page will be built from.

When redaction is not the best option

Redaction removes a fragment for good and suits cases where the recipient does not need it. In three situations something else works better.

The recipient needs all the data, but the file must not travel further. A passport copy for an agency or a landlord is not painted over but marked: a watermark from Add watermark with the purpose and the date makes any reuse of the copy conspicuous. The details are in the article on watermarking copies of documents.

The document comes from a word processor rather than a scanner, and the text layer on the page must be kept. The general approach to redaction styles and to what to look for across the whole document is in the article on removing sensitive data from a PDF.

Almost the whole page needs hiding. Then the page is removed entirely rather than painted over, and no question remains of what was under the area.