tags: [privacy, security, productivity, career, technology]
A friend of mine once sent a "redacted" court filing to a journalist by blacking out a name with a black box in her PDF editor, saving it, and sending it over. The journalist opened it, selected the black box, hit copy, and pasted the name in plaintext. The box was never actually redaction — it was a rectangle drawn on top of the text, and the text was still sitting underneath it in the document, fully selectable and fully searchable.
That's the most dramatic version of a problem that's actually much broader and much quieter: PDFs carry far more information than what's visible on the page, and almost nobody checks for it before hitting send.
What's actually inside a PDF beyond the visible text
Open the "Document Properties" panel on basically any PDF you've generated recently and you'll usually find some subset of:
- Author name — often your real name or your company's default account name, even on documents you meant to send anonymously
- Software and version used to create it — sometimes revealing internal tools
- Creation and modification timestamps, down to the second
- GPS coordinates — if the PDF was generated from a photo taken on a phone with location services on (common with scanned-document apps), the coordinates can ride along in the embedded image's EXIF data
- Edit history and revision tracking, in some Word-to-PDF exports
- Hidden or "deleted" content that isn't actually deleted — text layers left behind under images, tracked changes not fully flattened, or — as in my friend's case — a black box drawn over live, selectable text rather than genuine redaction
None of this is a bug, exactly. It's metadata that PDF-generating software includes by default because it's useful internally — for search, versioning, provenance. It just wasn't designed with "I'm about to send this to someone I don't fully trust" in mind.
Who actually runs into this
It's easy to file this under "sounds like a lawyer's problem," but it shows up in ordinary situations more than you'd expect:
- Job seekers sending a resume that still has an old employer's template metadata baked in, or a home address embedded from when the file was first created
- Freelancers and consultants sending a scanned contract where a supposedly-redacted client name is still selectable text under a black box
- Anyone sending a screenshot-to-PDF of something private, where GPS metadata rode along from the original photo
- Journalists and researchers handling sensitive source documents, where a "clean" redaction is the entire point
Actual redaction vs. drawing a black rectangle
The distinction matters enough to say plainly: covering text with a shape is not redaction. Real redaction removes the underlying content from the document entirely, so there's nothing left to select, search, or extract — the text isn't hidden, it's gone. Most free "edit PDF" tools only offer the shape-on-top version, because true redaction requires actually parsing and rewriting the document's content stream, not just adding a visual layer.
I built an actual redaction tool into ihatepdf.cv for exactly this reason — it removes the selected content rather than covering it, and since it runs client-side, the sensitive document you're redacting never gets uploaded anywhere in the process either, which matters more the more sensitive the document is.
A short checklist before you send anything sensitive
- Check document properties for author name, company name, or anything you didn't intend to disclose
- If you scanned a document from your phone, be aware GPS metadata can survive the trip from photo to PDF
- If you're redacting, verify you can't select or search the "hidden" text — if you can, it's not actually redacted
- Flatten tracked changes before exporting from Word — a PDF export can retain revision history that a casual "Accept All Changes" doesn't fully clear
- When in doubt, process the file somewhere that doesn't upload it to a third-party server in the first place — one less place for the metadata to be logged, even if the tool itself is trustworthy
None of this is exotic security advice — it's closer to checking your email's CC field before hitting send. It just isn't habitual yet, because PDFs feel like static, inert files in a way that makes it easy to forget how much they're actually carrying.
If you want to check what a document of your own is exposing, or actually redact something properly, the tool's free and runs entirely in-browser at ihatepdf.cv. Curious if others have a "found something I didn't expect in a PDF" story — feel free to share in the comments.
Top comments (0)