Steps
Black out what must not be seen
Choose the PDF. Type a name or number and press Redact matches to box every place it appears, or tick Emails, Phone numbers or Long numbers. Drag on a page to box a signature, photo or anything else by hand, and tap a box to remove it. Apply redactions turns each page with a box into an image with the boxes burned in, so the text under them, and the rest of that page's text, is gone from the file. Comments and form values on other pages that contain a searched-for text are removed too.
Remove the hidden metadata
The redacted PDF opens with its properties listed. Press Remove all metadata: the document information (title, author, subject, keywords, creator, producer and dates) is deleted, along with the XMP metadata streams and private application data that viewers do not show.
Mark it Confidential
Optional. CONFIDENTIAL is filled in; change the text, colour, opacity, size or layout (diagonal, centred, tiled or a footer line) and choose pages if needed, then press Add watermark. You can use a PNG or JPEG logo instead of text.
Add a password
Optional. Type a password twice; the meter shows how strong it is. Under Permissions you can block printing, copying or editing. Protect PDF encrypts the file with AES-256. Send the password by a different channel from the file.
Requirements and sources
| What | Value | Source |
|---|---|---|
| Why covering text is not enough | information hidden or covered in a computer document can almost always be recovered. The way to avoid exposure is to ensure that sensitive information is not just visually hidden or made illegible, but is actually removed from the original document. | NSA: Redacting with Confidence: How to Safely Publish Sanitized Reports Converted From Word to PDF (I333-015R-2005), copy hosted by the US Court of Appeals for the Seventh Circuit Last verified 2026-10-22 |
| Converting to PDF keeps metadata | merely converting an MS Word document to PDF does not remove all metadata automatically. | NSA: Redacting with Confidence (I333-015R-2005) Last verified 2026-10-22 |
| AES-256 encryption used by Add a password | If key-length is 256, the minimum PDF version is 1.7 with extension level 8, and the AES-based encryption format used is the one described in the PDF 2.0 specification. | qpdf manual: Running qpdf (--encrypt) Last verified 2026-10-22 |
| Older PDF passwords to avoid | 40-bit encryption is insecure, as is 128-bit encryption without AES. | qpdf manual: Running qpdf (--encrypt) Last verified 2026-10-22 |
FAQ
Can someone remove a black box and read the text underneath?
Not with this workflow. A page that has a box is rebuilt as an image with the box burned in, so there is no text left under it to copy, search or uncover. The trade-off is that the other text on that page is no longer selectable; pages without boxes keep their text.
What does Remove all metadata take out?
The document information dictionary (title, author, subject, keywords, creator, producer, created and modified dates), every XMP metadata stream, including ones attached to single pages or images, and private application data (PieceInfo). The page content itself is not changed.
Why remove metadata if I already redacted the pages?
Metadata travels separately from the pages. A title such as "Statement for Jane Doe" or an author name stays in the file after the visible text is blacked out, and many viewers show it in a properties panel or a browser tab.
Does the password stop people sharing the file?
No. It stops people who do not know the password from opening it. Anyone you give the password to can open, print or forward the file unless you also turn off printing or copying, and those permission flags are honoured by most, but not all, PDF viewers.
Is my document uploaded anywhere?
No. Every step opens and saves the PDF in your browser. Only the PDF engines (pdf.js, pdf-lib and qpdf compiled to WebAssembly) are downloaded from a public CDN.