Why Drawing a Black Box on a PDF Doesn't Redact It (And How I Built a True Client-Side PDF Redactor with Canvas & WebAssembly)

Manumattam — Fri, 06 Nov 2026 18:01:34 +0000

One of the most common document security mistakes on the web is "black-box PDF redaction."

When people need to hide an Aadhaar number, PAN, SSN, or bank account balance on a PDF, they often open a free online PDF editor, draw a black rectangle over the text, and hit save.

The Problem: The Text Stream Is Still There

In the PDF specification (ISO 32000), drawing a rectangle annotation or vector path over existing text only changes the visual stacking order (z-index). The original BT ... ET text object remains untouched in the underlying content stream. Anyone who opens the PDF can simply press Ctrl+A, Ctrl+C, and paste the "redacted" text into Notepad.

Even worse, using a traditional online PDF tool means uploading your unredacted confidential document to a third-party server first.

How I Solved Both in the Browser

While building Sahuliyat (a privacy-first platform of 46 client-side tools), I wanted to build a PDF Redactor and PDF Unlocker where 0 bytes ever leave the user's browser.

Here is the client-side pipeline:

Local Rendering via pdfjs-dist: Each PDF page is parsed locally in a Web Worker and rendered at high DPI onto an HTML5 <canvas>.
Pixel-Buffer Destruction: When you draw redaction boxes over sensitive areas, those coordinates are burned directly into the 2D canvas bitmap—overwriting the original RGB pixels completely.
Flattened Reconstruction via pdf-lib: The modified canvas frames are exported and assembled into a fresh PDF document with zero underlying text streams or metadata left behind.
Local AES-256 Encryption / Decryption via QPDF WebAssembly: For Unlock PDF and Protect PDF, we run @neslinesli93/qpdf-wasm inside a Web Worker so passwords and financial PDFs never touch the network.

Try It Out (Open Your DevTools Network Tab!)

You can test the full suite here: https://sahuliyat.com

Alongside the PDF & image privacy tools, it also includes:

PDF Compressor & Merge PDF
Image EXIF Metadata Remover
JSON Formatter, Cron Expression Parser, and Text Diff Checker
Income Tax Calculator (AY 2026-27) & Home Loan Prepayment Calculator

Would love feedback from fellow developers on the WebAssembly worker architecture and UX!

DEV Community: Manumattam

Why Drawing a Black Box on a PDF Doesn't Redact It (And How I Built a True Client-Side PDF Redactor with Canvas & WebAssembly)

The Problem: The Text Stream Is Still There

How I Solved Both in the Browser

Try It Out (Open Your DevTools Network Tab!)