Hiding an ID number, address or bank details in a PDF: why a black box is not enough
Why text survives under a black box, how to remove it for real, and how to check before you send
You are about to send a document for a rental application, a complaint or an insurance claim. Some lines are none of the recipient's business: your national ID number, your home address, your bank account details. In the PDF reader you drew a black rectangle over them, or in Word you painted the text black and saved it as a PDF. On screen, nothing can be read.
Unfortunately, in most cases the information is still inside the file. Anyone who selects the area under the black box and pastes it somewhere else reads your number in full. This guide explains why the box is not enough, how to take the information out of the file for real, and how to confirm that with your own eyes before you press send.
Why does the text survive under a black box?
Think of a PDF page as transparent sheets stacked on top of each other. The text sits on one sheet; the box, highlight or comment you add afterwards is a separate sheet laid over it. The top sheet fools the eye, but the letters underneath do not move. As far as the computer is concerned, the page still says "12345678901"; there just happens to be a black shape on top.
Setting the highlight colour to black in Word ends the same way: the letters look black on black, but they are still text, and saving as PDF carries that over unchanged. If the box was added as a comment, it is even easier for the recipient: one click deletes it, or they can simply view the page with comments hidden.
You can test your own file in two minutes. Open the document, press Ctrl+A (Command+A on a Mac) to select all the text, Ctrl+C to copy it, and paste it into Notepad or any blank document. If the number you thought you had hidden appears there, it is not hidden. The second test is search: press Ctrl+F and type the first few digits; if the reader jumps to the spot under the box, the text is still there.
At a glance: covering versus removing
The diagram shows how the same line sits in the file after two different operations. On the left the text layer is untouched and the box is merely drawn over it; on the right the letters have been taken out of the text layer and the box marks the gap they left.
Which methods actually remove the information?
Depending on what you have to hand, there are several routes. They all face the same test: what comes out when the area under the box is copied? The table ranks the common methods against that test.
| Method | Does the text stay in the file? | What to watch out for |
|---|---|---|
| Rectangle or pen comment in a PDF reader | Yes, it stays | Delete or hide the comment and the text shows |
| Black shape or black highlight in Word, then PDF | Yes, it stays | Copy and paste reads it in full |
| Screenshot of the page turned into a PDF | No, the page becomes a picture | Text selection and search are lost for the whole page |
| Covering it on paper and scanning again | No, the page becomes a picture | A thin or light marker may not fully cover the text |
| Redact PDF tool | No, the letters are deleted | It only finds what you type and the finders you switch on |
Step by step with the Redact PDF tool
Give your file to the tool and type everything that must go into the box, separated by commas: your name, your ID number, the street and house number of your address. Case and spaces do not matter, and accents are ignored too, so typing "rene dupont" also finds "RENÉ DUPONT". Then open the ready-made finders list and choose the option with emails, phone numbers and IBANs.
One detail is worth knowing: the ready-made finders do not recognise national ID, social security or tax numbers. What the phone finder looks for is a number opening with a plus sign, a zero or a bracket and holding between 9 and 15 digits in total, or one laid out in the 3-3-4 pattern; the IBAN finder accepts a match only when its two check digits work out, so a domestic account number without the country letters in front slips past it. Type such numbers into the box yourself.
When you press Redact, the tool deletes the matching letters from the page's text layer, puts a gap of the same width in their place so the line does not shift, and then draws the black box into the page itself. It next reads the file it produced from scratch with a second, independent PDF engine. If the search term can still be extracted, it turns that page into an image, blacks out the affected lines and reports it on the result line; if even that fails, no file is produced. The result line lists how many matches were removed on which page: compare it with the number you expected.
What the tool cannot see is just as clear: on a scanned page or one photographed with a phone, the text is nothing more than pixels in a photo, so there are no letters to search for. A photo of an ID card pasted into the document is also just a picture. In that case the most reliable route is to cover the information on paper and scan the page again.
The places you do not see: author name, comments and file name
Cleaning the text on the page is half the job. Inside the PDF there is also a properties block that never shows on the page: programs such as Word write your name or the licence holder's name into the Author field, along with the document title and the program used. The redaction tool only masks the parts of those fields that match what you typed; if you did not type your name, it stays in the Author field as it was. To empty the block completely, run the file through the Remove PDF Metadata tool after redacting.
Comments and sticky notes added earlier each carry the name of the person who wrote them. The Remove Annotations from PDF tool clears them in one go. Finally, look at the file name: something like "John_Smith_ID12345678_application.pdf" gives the game away however clean the content is. The redacted copy is named by adding "-redacted" to the original name, so before sending, right-click the file and use Rename to give it a neutral name.
Final checklist before you send
Redaction cannot be undone, so the check runs both ways: has everything you meant to hide gone, and has nothing you meant to show been removed by mistake? The steps below take five minutes.
- In the redacted file, copy all the text with Ctrl+A and Ctrl+C and paste it into a blank document; nothing you hid should appear
- Search with Ctrl+F for the first four digits of your ID number and for your surname; there should be no result
- Scroll through the pages: is the same number written another way in a table, a footnote or a header
- In the document properties (Ctrl+D in Acrobat Reader), check that the Author field is empty
- Rename the file to something neutral
- Keep the original, unredacted file on your own computer; it is the only way to undo a redaction
Frequently asked questions
Can text I covered with a black box in a PDF still be read?
If the box was added as a comment, shape or highlight, yes; the text underneath stays in the file and comes out with copy and paste or search. You can test this right away by copying all the text in your file with Ctrl+A and Ctrl+C and pasting it into a blank document.
Do the ready-made finders catch my ID or social security number?
No. The ready-made finders cover email addresses, phone numbers and IBANs. Type your ID, social security or tax number into the words box yourself; whether it is written with spaces or without makes no difference.
How do I redact a scanned document?
On a scanned page the text is part of a picture, so this tool cannot find it and says so without changing the file. The most reliable route is to cover the information on paper with a thick, dark pen, scan the page again and zoom in to make sure it cannot be read.
Can I undo the redaction later?
Not in the redacted file; the letters have been removed from it. That is why you should keep the original. If you blacked out the wrong thing, start again from the original file.
Is my document uploaded to a server for redaction?
No. No upload takes place: the page's own code finds and removes the text on your computer or phone. Nothing you type into the box is transmitted either, which is the whole point when the aim is to keep personal data private.
Last updated: October 12, 2026