In 2019, lawyers for Paul Manafort filed a document in which the “redacted” passages could be read by anyone who copied the text and pasted it elsewhere. It made headlines, but it’s an everyday mistake: a black rectangle drawn on top of a PDF covers the text without removing it.
Good redaction tools remove the content underneath. Plenty of people still use a shape tool, a highlighter set to black, or a redaction they marked but never applied. Here’s how to check before anything leaves your hands.
Five checks
Copy and paste
Select the text across a redaction, copy it and paste it into a plain text editor. If the hidden words appear, they were never removed.
Search for what you hid
Press Ctrl+F (⌘F on a Mac) and search for a redacted name or number. Any match means it's still in the file.
Remember the scan's hidden text
A scanned PDF that you can search has an invisible layer of recognized text behind the image. Blacking out the image leaves that layer behind. Check 1 and 2 catch it.
Look beyond the page
Open the document properties: author, title and subject often hold names. Then check comments, bookmarks and attachments. In Word, accept or reject every tracked change and delete comments first. Photos can carry the GPS location where they were taken.
Send a fresh copy, not an edited one
PDFs can keep earlier versions inside the file when they're edited and saved. Use your tool's "apply" or "sanitize" step and send the newly saved file, not the working copy.
How Veil handles it
Veil skips the question of what’s underneath: each page with a redaction is rebuilt from an image with the boxes burned in, so the original text, fonts and hidden layers don’t come along. The export is a new document, with no metadata, bookmarks, scripts or attachments carried over from the original. Images are re-encoded, which drops their location data. Word files have each redacted value replaced throughout the body, headers, footers, notes and comments.
If someone asks how you know, an optional certificate lists what was removed by category and page, with a fingerprint of the original file. It never includes the removed text.
Whatever tool you use, run the five checks above. They take two minutes, and they’re the difference between a redaction and a black box.