Redacting a PDF so the text is actually gone.

A PDF page is not a picture of a document. It is a list of instructions: put this glyph at this coordinate, in this font; fill this rectangle with black. The viewer executes them in order, and what you see is the result of the last instruction to touch each pixel.

Draw a black rectangle over a name and you have added one instruction to the end of the list. Every earlier instruction is still there, in order, including the one that places the name. The viewer draws the name, then draws black over it. The name is not hidden in the file — it is first in the file.

Select the area, copy, paste into a text editor, and it comes back. This is not an exotic attack. It is the ordinary behaviour of the format, and it is why courts, regulators and newspapers have all at some point published documents whose black bars came off with two keystrokes.

The three ways it keeps happening

Nobody sets out to publish a name. Three specific habits produce the same file.

The annotation. The highlighter and rectangle tools in most viewers create annotations — objects that live alongside the page rather than in it. They can be selected and deleted by the recipient in the same viewer that drew them. Some viewers will even offer to hide all annotations from a menu.

The drawn shape. Slightly better: the rectangle is written into the page content and cannot be clicked away. The text underneath is untouched all the same.

The print-to-PDF. Printing the marked-up file back to a new PDF does flatten the rectangle into the page — and it feels like it must have worked, because the file is visibly new. But most print paths preserve the text layer, because that is the point of printing to PDF rather than to an image. The result looks flattened and copies just fine.

What removal actually requires

Two different jobs, depending on how the page carries its words.

A born-digital page — a contract exported from a word processor — carries real text objects. Redaction means deleting those objects from the page's content stream, not covering them. The glyphs stop existing; the black rectangle that replaces them is cosmetic, a mark of where something was removed.

A scanned page carries an image, and often an invisible text layer added by character recognition so that the document is searchable. Redaction here means two removals: the matching pixels of the image have to be rewritten, and the recognised text underneath has to be deleted. Doing only one is the classic half-failure — a page that looks redacted and searches perfectly for the name you thought you removed.

Where else a name hides

The page body is the obvious place, and rarely the only one. Before a file goes out, look at:

• Document metadata — title, author, subject, keywords. A file whose author is the client and whose title is Smith divorce — draft 3 tells the story without a single page being read.
• The filename. It travels with the file, and it is the first thing anyone sees.
• Bookmarks and the outline, which frequently repeat section headings containing names.
• Attachments and embedded files — a PDF can carry a spreadsheet inside it.
• Form fields, whose stored values are separate from what is displayed.
• Earlier revisions. A PDF saved incrementally keeps the previous version appended in the same file. Saving a full copy, rather than an incremental update, discards it.
• Layers in drawings and plans, which can be switched off visually and switched back on by the recipient.

Checking a file in two minutes

Do this on the finished file, the one you are about to send — not on the one you were working in.

• Select all, copy, paste into a plain text editor. Read what comes out. This alone catches the great majority of failures.
• Search the file for each removed name, and for fragments of them.
• Open the document properties and read the metadata.
• Compare the file size. A genuinely redacted scan is usually a different size, because the image was rewritten. A file that is byte-for-byte the size of the original plus a few kilobytes probably just gained some rectangles.
• If you have command-line tools to hand, pdftotext on the finished file is the most direct answer there is.

One habit worth adopting

Redact from a copy, and keep the unredacted original somewhere separate and clearly named. Redaction is destructive by definition; if it is not destructive, it did not happen. The failure mode you want is having to redo the work, never having sent the name.