DEV Community: Linas Jonas

Three PDF redaction failures worth studying

Linas Jonas — Sat, 03 Oct 2026 22:22:49 +0000

You do not need a clever exploit to recover some badly redacted PDFs. You need a text editor and copy and paste.

That sounds too simple for a serious leak. It has happened in military reports, airport-security documents and court filings.

2005: the Calipari report

The US Army published a report about the incident in Iraq in which Italian intelligence officer Nicola Calipari was killed. Parts of the PDF appeared blacked out, but the underlying text remained recoverable.

The preserved report on Wikisource records the failed redaction. The useful lesson is about the file, not its subject: content can be invisible on a rendered page and still exist in the document.

A reviewer looking only at the page could miss that distinction.

2009: TSA screening procedures

A TSA screening-procedures document posted on a federal procurement site contained improperly redacted sensitive security information. The incident prompted a Department of Homeland Security inspector general review.

The document was meant to be shared in a limited form. Covering portions of it did not make that form safe to publish.

This is why a workflow needs a check on the exported file, not just a check that someone marked the right paragraphs.

2019: a Manafort court filing

A filing by Paul Manafort’s lawyers displayed black rectangles over passages that were still accessible through copying and pasting. The American Bar Association’s account explains how text transferred into a separate document became readable.

The filing was later replaced, but replacement cannot make already downloaded copies disappear.

You do not need to repeat the exposed material to learn from the failure. The publication check happened too late.

Same mistake, different offices

These incidents span fourteen years. They do not show that PDFs are impossible to redact. They show why appearance is the wrong success criterion.

A PDF can hold text, images and annotations as separate objects. Putting a solid shape over text changes what the reader sees. It does not necessarily remove the text object.

Using a real redaction feature matters. So does applying the redactions, exporting correctly and testing the result before it leaves your control.

A check you can add today

Open the exported file in another reader. Select across the covered region, copy and paste into a plain text editor. Search for distinctive words or numbers you intended to remove.

If they appear, stop sharing that export.

Passing this test is not a complete security proof. Inspect metadata, comments and attachments too. A scan may contain both an original image and an OCR layer, and either can preserve information. High-sensitivity material deserves a more thorough inspection than a quick visual pass.

I build hddn, a browser-based PDF redaction tool. My rule is the same regardless of the editor: check the file you are about to send. A page that looks right is only the beginning.

Adapted from hddn’s guide to redaction failures.

How to redact a PDF for GDPR

Linas Jonas — Sat, 03 Oct 2026 22:22:20 +0000

You remove the names from a staff report. Then you leave the job title, start date and a paragraph about the only person who works weekends.

The name is gone. The person may still be obvious.

Read for identity, not just patterns

A detector can find email addresses, phone numbers and IDs. It cannot reliably judge what your recipient already knows. Read the surrounding sentences, tables, signatures and captions. In a small team, a role or an unusual incident can identify someone without a name.

Under GDPR, personal data includes indirect identification. Replacing names with codes is not necessarily anonymisation. If additional information can reconnect those codes to people, you may have pseudonymised personal data instead. Recital 26 asks whether identification is reasonably likely, not whether you personally intend to try.

That distinction matters before you call a document “anonymous”.

Decide what needs sharing

Start with the purpose and audience. What does this recipient need to understand? Keep information that serves that purpose and remove unnecessary personal details.

Sometimes a summary is a better answer than a heavily redacted source document. It may preserve the useful facts without carrying pages of unrelated information along with them.

For anything legally sensitive, involve your data protection officer or counsel. This is a practical file-handling checklist, not a compliance opinion.

Remove content, then check the export

Use a real redaction operation and apply it. A black rectangle may be an annotation sitting above readable text. Keep the original separately, then export a sanitised copy.

Open that copy in a different reader. Search for removed names and distinctive identifiers. Copy across the redacted region and paste into a text editor. Check document properties, comments, form fields and attachments too.

Those checks catch common failures. They do not establish that every hidden object is clean. Scanned pages need their underlying pixels and any OCR text layer checked as well.

Local processing reduces one exposure

Uploading an unredacted PDF gives the service the information you are trying to remove. Check whether that transfer is appropriate before making it.

A genuinely local tool avoids that document upload. It does not exempt your organisation from GDPR. Your lawful basis, security controls and applicable record-keeping duties still matter. If a provider processes personal data on your behalf, assess the processor arrangements and any international transfers.

I build hddn, which processes documents in your browser and lets you review detection candidates. Local processing is useful. It is not a compliance certificate.

If a bad export has already left

Stop further sharing and follow your incident process. Article 33 generally requires supervisory-authority notification within 72 hours of awareness, where feasible, unless the breach is unlikely to create risk to people’s rights and freedoms. Not every mistake automatically requires notification. Do not guess at that assessment alone.

The legal reference is the GDPR regulation, particularly Recital 26 and Articles 4, 28 and 33.

Adapted from hddn’s GDPR redaction guide.

How to redact a scanned PDF

Linas Jonas — Sat, 03 Oct 2026 22:20:51 +0000

You drag across a name in a scanned contract. Nothing highlights. Every tutorial says “select the text”, but there is no text to select.

The name may be pixels inside a page image. Redacting that page means removing those pixels from the exported file, not covering them with a separate object.

Check whether the scan has a text layer

Many scanners create searchable PDFs. They keep the page image and add invisible OCR text over it.

Now there are two copies of the name: a photograph and an extractable string. Covering one does not remove the other.

Try selecting a line and searching for a word you can see. If either works, account for the OCR layer. Check every page. A typed cover sheet followed by scanned pages is common, and one test on page one says nothing about page twelve.

Burn the redaction into a new image

A rectangle saved as an annotation is a separate PDF object. It may be movable or removable. Even if the reader offers no delete button, the original image can remain inside the file.

An image-based export can work when it renders the page with the redaction already applied, then builds a fresh PDF from the resulting pixels. The sensitive pixels must be overwritten, and the original image must not be retained elsewhere in the output.

Do not assume a button labelled “flatten” guarantees this. Different tools use the word differently. Printing to PDF is not a reliable substitute either; the result depends on the application and print pipeline.

OCR helps find things, not decide for you

Recognition can find names, dates and ID-like numbers and return their page coordinates. That makes marking a long scan much easier.

It also makes mistakes. Faint copies, skewed pages and handwritten notes are easy to miss. A 5 becomes an S. Read the pages yourself and treat detected candidates as a first pass.

Then apply the image redactions and remove any corresponding OCR text. Accurate detection does nothing if the export keeps the underlying content.

Inspect the final file

Open the export in another reader. Try selecting and searching again. Check that you cannot remove or move the covering shapes to reveal information.

For sensitive work, inspect extracted images and text too. A clean-looking page can coexist with an unredacted thumbnail, attachment or older revision.

Export to a fresh file, inspect document properties, and make sure the page is still readable. Some image exports reduce resolution enough to make the remaining text unpleasant to use.

I build hddn. OCR runs in the browser, candidates need your approval, and its flattened scan export burns confirmed boxes into the page bitmap. It does not pretend OCR pages are ordinary editable text.

A scan that does not respond to copy and paste is not automatically safe. Find out what is inside it before drawing the first box.

Originally published in hddn’s guides.

How to remove text from a PDF permanently

Linas Jonas — Sat, 03 Oct 2026 22:20:22 +0000

Fixing a mistyped VAT number and removing a salary from a contract sound like the same task: delete some text from a PDF.

They are different jobs. One needs a correct-looking page. The other needs the old information to be unrecoverable from the file you hand over.

Editing is not redaction

Replacing a word is an editing operation. PDF text is positioned on a page, often glyph by glyph, so changing it can leave gaps or cause font problems.

Embedded fonts may contain only the characters used in the original document. Your replacement might need a character that is missing. Check the exported page at full zoom, especially after changing more than a word or two.

Sensitive text has a stricter requirement. A white rectangle, black box or replacement label can change the appearance while leaving the original content underneath.

Use a redaction feature when the old text has to go. A warning that an operation cannot be undone is useful, but it is not proof of correct output. The exported file still needs checking.

Permanent means absent from the output

PDFs can contain earlier revisions when changes are saved incrementally. A program may append an updated page instead of rewriting the old bytes.

That is one reason a visual check is too weak. You need an output workflow that removes the sensitive content rather than simply hiding it or adding another version.

If you are both editing and redacting the same area, check what happens where those operations overlap. A replacement typed over a redaction region must not accidentally survive the redaction you intended.

The page is only one place to look

Metadata can name the author or client. Comments and annotations may quote the passage you removed. Attachments travel inside the PDF. A cropped image can retain pixels outside the visible crop.

Inspect those separately. Exporting under a fresh filename is a good way to preserve your source, but it does not automatically sanitise everything in the new file.

Check what someone else receives

Open the export in a different reader. Select across the removed area, copy and paste into a plain text editor. Search for distinctive text that should no longer exist.

For a sensitive file, also extract the text with a tool such as pdftotext and review that output. Empty search results are not a complete forensic guarantee, especially when information lives in images or attachments.

Scanned pages need image redaction as well as removal of any OCR text. Changing a text layer does not erase a photographed name.

I build hddn, which supports native-text edits and confirmed redactions in the browser. Text editing has limits: scanned pages, rotated lines and right-to-left text are refused rather than silently altered.

The editor shows your intention. The exported file is the evidence. Check the second one.

Originally published in hddn’s guides.

How to redact a PDF without uploading it

Linas Jonas — Sat, 03 Oct 2026 22:19:59 +0000

Some files should not go onto a stranger’s server just so you can remove four names. A client file. An HR investigation. A document covered by a confidentiality agreement.

Dragging a PDF onto a web page feels like a small action. If that tool processes files on a server, it is a transfer of the whole document, before any redaction happens.

Deletion promises are still promises

An uploaded file may pass through memory, temporary storage and backups. The exact path depends on the service. A vendor saying “deleted after one hour” may be telling the truth, but you cannot confirm its internal cleanup jobs from your browser.

That does not make every server-side tool unsafe. It means choosing one involves trusting the operator and checking whether that processing is appropriate for your document.

A web tool can work locally

There are two very different kinds of PDF website. One uploads your file, processes it elsewhere and returns a download. The other runs PDF code inside your browser and reads the file on your device.

The interface can look identical. “Private” and “secure” do not tell you which model you are using.

Desktop software is another local option. It may be the right answer if you already have a suitable application installed. You still need its actual redaction feature, not a drawing tool.

Test with a harmless file

Make a test PDF with no private information. Use that for the checks, not a patient record or client contract.

Open the browser’s developer tools and select Network. Enable Preserve log. Load the test PDF and complete the workflow, including export.

Look at outgoing requests and their payloads. A POST or PUT carrying the file is a clear upload signal. Do not rely on matching file size alone: uploads can be split, compressed or encoded. A large incoming response is not evidence of an outgoing document transfer.

Then test without a network connection. Let the application and any required assets load, disconnect, open the harmless file, redact it and export.

If the complete job works while disconnected, that processing happened locally. It does not prove the application will never send anything later, which is why the network check matters too.

Local does not mean no downloads

The page itself has to load. OCR tools may fetch recognition models on first use and cache them afterwards. Those downloads are different from sending your PDF to a server.

A failed first offline attempt may mean an asset was not downloaded yet. It is not, by itself, proof of server-side processing.

I build hddn. Its document processing runs in the browser; OCR and detection assets may download when first needed. Detection produces candidates for you to review, not a promise that every sensitive detail was found.

Run the checks on the version you are using. Tools change, and the interface does not have to change with them.

Originally published in hddn’s guides.

How to redact a PDF and know it worked

Linas Jonas — Sat, 03 Oct 2026 22:19:11 +0000

The file is open. Someone needs it this afternoon. You have marked the names and account numbers, and the page looks clean.

That is not the end of the job. The file you export is what the recipient gets, and it may not match what your editor shows.

Start with the right file

Use the original PDF when you can. Native text lets detection tools find patterns and lets you select exactly what needs removing. A printed-and-scanned copy turns the pages into pictures. That needs a different treatment.

Try selecting a line. If nothing highlights, look for an image-redaction workflow that changes the pixels and rebuilds the page. A rectangle stacked above the original scan leaves that image intact. Some scans also have an invisible OCR text layer, so check each page rather than assuming the whole document is one format.

Decide what the recipient should see

Before opening the redaction tool, write down who will receive the document and what they already know.

Names are the obvious part. Check initials, signatures, contact details, IDs, account numbers, dates of birth, home addresses and salary figures too. Read the prose. “The contractor who left halfway through the March audit” might identify one person without naming them.

Automatic detection helps with the first pass. It does not make the decision for you. Review the suggestions, reject false positives and look for what the detector missed.

Use redaction, then apply it

Drawing a rectangle is a drawing operation. It can hide text on screen while leaving the original string in the PDF.

Use the feature called Redact or Mark for Redaction. Marking alone may still be an annotation: many applications require a separate Apply step. Follow the tool’s documented workflow, then export a fresh file without overwriting your original.

A new filename alone does not prove that old content or saved revisions are gone. Use a tool that removes the content and rewrites the output, then inspect it.

Look beyond the page

Document properties can contain an author, client name or title you did not mean to disclose. Comments, form fields and attachments can hold separate copies of the information. Cropping an image may hide its edges without deleting them.

Remove sensitive material from those places as well.

Test the export

Close the editor and open the exported PDF in another reader. Select across a redacted area, copy it and paste into a plain text editor. Search for a distinctive name or number you removed.

If it comes back, stop. The export is not clean.

Passing these quick checks is useful, but it is not proof that every hidden object is safe. For sensitive documents, inspect metadata, attachments and extracted text as well. Scans need their image pixels and OCR layer checked.

I build hddn, which processes PDFs in the browser and lets you review detected candidates before applying redactions. Whatever tool you choose, test the exported file. Your careful markup is not what leaves your computer.

Originally published in hddn’s PDF redaction guides.

Your black rectangle is not redacting that PDF

Linas Jonas — Wed, 16 Sep 2026 17:35:30 +0000

Someone asks you to send a contract with the salary taken out. You open the PDF, grab the rectangle tool, drop a black box over the number, save, send. It looks right. The number is gone.

It isn't. It's underneath.

What the file actually contains

A PDF is not a picture of a page. It's a list of instructions: draw this glyph at this coordinate in this font, then this one, then this one. The text you see is a real string sitting in the file's content stream, with the positions that let a reader lay it back out.

When you draw a rectangle, you add one more instruction to that list. Paint a filled shape at these coordinates. That instruction runs after the text, so the shape lands on top and your eye stops there.

The text instruction is still in the file. Untouched. Select the area and copy, and your clipboard gets the words, because selection reads the content stream, not the pixels. Run any extraction library over it and the same thing comes out. So does search. So does a screen reader.

This is not a bug in whatever tool you used. Drawing a box is a drawing operation, and it did exactly what a drawing operation does.

It has gone wrong at scale

In 2005 the US Army published its report on the shooting of Nicola Calipari in Iraq as a PDF with sections blacked out. Copy the page into a word processor and the blacked-out sections came back, including names and troop movements. The Pentagon pulled the file; by then it was mirrored everywhere.

In 2009 the TSA posted its screening procedures manual with the sensitive sections covered the same way. Researchers had the full text out within hours.

In 2019 Paul Manafort's lawyers filed a court document with black bars over several passages. Reporters copy-pasted them and found, among other things, that he had shared campaign polling data with Konstantin Kilimnik.

Three organisations with lawyers, review processes, and a strong interest in getting it right. The failure mode does not care how careful you are, because it doesn't look like a failure until someone else finds it.

Real redaction removes the content

For the text to be gone, the instruction that draws it has to be deleted from the content stream and the file rewritten without it. Proper redaction tools do this. They mark a region, work out which glyphs fall inside it, strip those from the stream, then paint the black box as a visual marker of what was taken out.

Two different operations that produce the same screenshot. Only one of them changes what the file contains.

The same applies to everything else riding along in the document. Metadata with the author's name and the original filename. Previous versions kept in an incremental-save history. Comments and annotations. Attached files. A cropped image that still holds the full picture outside the crop box. Any of these can carry the thing you meant to remove.

Checking a file you already sent

You don't need a specialist tool for the basic test.

Open the PDF in any reader. Select across the area you redacted, copy, paste into a plain text editor. If your text appears, the file is not redacted. Then press Ctrl+F and search for a word you removed. A hit inside a black box means the same thing.

That catches the common case in about ten seconds. It won't catch metadata, annotations, or content hiding outside the visible page area, so for anything sensitive, treat the copy-paste test as the floor rather than the ceiling.

The rest of it

The full guide covers how to fix it at source: which tool operation actually
removes content, what else in the file carries the thing you deleted, and why
you have to verify the exported bytes rather than the document you were
editing.

Read the rest on hddn.app