Redacting a PDF means permanently deleting the selected content so that it cannot be recovered by copy‑paste, OCR, or forensic tools. Using a genuine redaction feature protects you from costly compliance violations and safeguards the people whose data you handle. The guide below walks you through the legal backdrop, step‑by‑step procedures for the most common tools, a comparison matrix, and a checklist you can turn into a standard operating procedure.
Quick Answer: How to Redact a PDF in 2026
What is PDF redaction?
Definition: A redaction tool removes selected text, images, or metadata from a PDF’s data layer, ensuring the hidden content is unrecoverable.
Why visual overlays aren’t enough
Drawing a black rectangle with a shape tool merely hides the characters on the page. The underlying text remains in the content stream and can be extracted with a simple pdftotext command or by stripping the overlay in a PDF editor. True redaction scrubs those characters and any associated metadata.
Key takeaway: only true redaction removes data
Dedicated redaction features—such as Preview’s Redact selection tool, Acrobat Pro’s Redact Text & Images, or PDF24 Creator’s Redact PDF option—guarantee permanent deletion. After you finish, verify the result by trying to copy text from the redacted area before sharing the file.
Why Redaction Matters in 2026
GDPR (EU)
Article 32 of the General Data Protection Regulation now requires demonstrable data sanitization for any personal data released outside the EU. Non‑compliant redactions can trigger fines of up to €20 million **or** 4 % of the organization’s global annual turnover, whichever is higher. Regulators also expect a retained redaction log for at least six years.
CCPA (California)
The California Consumer Privacy Act has broadened the definition of “personal information” to include derived data such as biometric identifiers. Each violation can be penalized at $2,500, rising to $7,500 for intentional or reckless breaches. There is no aggregate cap; penalties accrue per incident.
HIPAA (U.S. Health Sector)
The 2026 HIPAA rule adds a mandatory “sanitized‑before‑distribution” clause for electronic protected health information (ePHI). Failure to redact ePHI can lead to civil penalties ranging from $100 to $50,000 per violation, with a maximum annual penalty of $1.5 million for repeat offenders.
Real‑world impact
Recent court filings show that many organizations still rely on visual overlays, exposing sensitive data to attackers who use free extraction tools. A single leaked Social Security number can lead to identity‑theft lawsuits, reputational damage, and the regulatory fines outlined above.
Prerequisites & Legal Considerations
What you need before you start
- Access to a certified redaction tool (Preview, Acrobat Pro, PDF24 Creator, or an approved offline AI redactor).
- A secured copy of the original PDF (encrypted external drive, encrypted cloud storage, or a Time Machine snapshot).
- A written redaction policy that enumerates the data categories to be removed (PII, PHI, financial identifiers, etc.) and defines the approval workflow.
Legal obligations for redaction
Regulations require that the redacted version be auditable. In the EU, a “redaction log” must list who performed the redaction, when it occurred, and which sections were removed, and it must be retained for at least six years. In the United States, FOIA requests must be accompanied by a certification that the document was sanitized according to the National Archives guidelines.
Document integrity and audit trails
Acrobat Pro’s “Sanitize Document” feature creates a hidden audit trail embedded in the PDF. Preview logs the action in the file’s metadata, which you should later scrub with a metadata cleaner. For high‑risk environments, keep a signed PDF/A‑2b copy of the pre‑redaction file as immutable evidence.
How to Redact a PDF with macOS Preview (Free on Mac)
Starting the workflow in Preview
1. Launch Preview and open the target PDF.
2. Select View ▶ Show Markup Toolbar to reveal the editing icons.
3. Click the Redact selection tool—identified by a black box with a checkered pattern.
Marking the content you want to erase
Drag the Redact tool over any word, phrase, or image that must be removed. Preview draws a solid black bar with a subtle checkered texture, indicating that the underlying characters will be stripped from the file.
Applying redactions and cleaning metadata
When you have marked everything, choose File ▶ Export as PDF. Preview warns you that the redaction cannot be undone. Save the file under a new name (e.g., Contract_Redacted.pdf). To purge hidden metadata, run mdls in Terminal or use a third‑party sanitizer such as mat2.
Verifying the result
Open the exported file, select the redacted area, and attempt to copy the text. If nothing copies, the redaction succeeded. Keep the original in a secure backup for future reference.
Redact a PDF with Adobe Acrobat Pro (Industry Standard)
Launching the Redact panel
Open the PDF, then go to Edit ▶ Redact ▶ Redact Text & Images. The Redact panel appears on the right, offering black fill, custom colors, or overlay text options.
Removing text, images, and form fields
Drag the cursor over each element you need to delete. Acrobat automatically creates a redaction rectangle. For form fields, right‑click the field and choose Redact Field to erase the underlying data.
Sanitizing hidden data and metadata
Select Tools ▶ Protect ▶ Sanitize Document. This step removes hidden metadata, embedded JavaScript, and revision history—requirements for HIPAA‑compliant releases.
Batch redaction and automation
Acrobat Pro supports “Redaction Codes.” Define a pattern such as SSN: \d{3}-\d{2}-\d{4} and apply it across an entire folder. The batch process generates new files with “Redacted” appended to the filename while preserving the originals untouched.
Redact a PDF with Free & Web‑Based Tools (PDF24, PDFescape, etc.)
PDF24 Creator: Desktop workflow
1. Download PDF24 Creator from tools.pdf24.org and install it.
2. Open the PDF, then tick the Redact PDF checkbox.
3. Use the Add shape icon to draw a black rectangle over sensitive content.
4. Click Save PDF and download the sanitized file.
PDFescape Online: Pros & cons
PDFescape allows you to draw shapes directly in the browser. The free tier stores uploads on European servers for 24 hours only. Earlier versions left the original text intact beneath the overlay, so always verify the result with a copy‑paste test.
Emerging web apps and security notes
AI‑driven services such as iDox.ai claim automatic PII detection, but their free plans upload files to U.S. cloud providers, raising jurisdiction concerns. For confidential material, prefer offline tools that keep the data on‑premises.
Tool Comparison: Security, Features, and Cost
| Tool | Redaction Depth | Metadata Sanitization | Audit Trail | Cost (2026) |
|---|---|---|---|---|
| Preview (macOS Big Sur+) | Text & Images (true removal) | Manual via Terminal or third‑party | None built‑in | Free |
| Adobe Acrobat Pro | Text, Images, Form Fields, OCR layers | Sanitize Document feature | Embedded redaction log | $19.99 / month (Creative Cloud) |
| PDF24 Creator | Text & Images (true removal) | Basic metadata wipe | None | Free (donation optional) |
| PDFescape Online | Visual overlay only (no true removal) | None | None | Free tier; $5 / month for premium |
Real‑World Tradeoffs: Performance & Quality
Speed on large documents
Acrobat Pro uses multi‑threaded processing and can redact a 500‑page legal bundle in under a minute. Preview handles up to 200 pages comfortably but slows noticeably beyond that. PDF24 Creator’s desktop engine stays responsive up to 1,000 pages, while the free online version caps at 100 MB.
Quality of redaction (font, layout)
Acrobat lets you replace redacted text with custom overlay text (e.g., “REDACTED”) while preserving line spacing. Preview applies a solid black bar with a checkered pattern, which may shift surrounding layout slightly. PDF24 offers custom colors but no automatic overlay text.
Metadata leakage and forensic risks
Even after true redaction, hidden XMP packets can reveal the original author or creation software. Only Acrobat’s Sanitize feature and dedicated metadata scrubbers guarantee complete removal. Skipping this step leaves a “fingerprint” that has exposed whistleblowers in court filings.
Best Practices & Common Mistakes
Preview every redaction before export
Zoom to 100 % and inspect each rectangle. A missed character at 150 % can be invisible at lower zoom levels.
Verify hidden layers with a command‑line check
Run pdftotext -layout redacted.pdf -. If any redacted phrase appears in the output, the removal failed and you must redo the step with a true redaction tool.
Avoid shape overlays that only cover text
Tools that rely on drawing shapes (Google Docs, PDF24’s basic mode, PDFescape) leave the underlying data fully accessible. Use a dedicated redaction feature instead.
Maintain version control
Never overwrite the original file. Store a read‑only copy in a secure backup (Time Machine, encrypted cloud, or an offline vault) and retain it for the period required by your jurisdiction.
Document the redaction process
Create a short log that records the file name, redactor’s name, date, and the categories of data removed. Attach the log to the redacted PDF as a separate, non‑editable attachment for audit purposes.
Who Should Use Which Tool? (Personas & Recommendations)
| Target Persona | Recommended Option | Key Reason & Real‑World Benefit |
|---|---|---|
| Freelancers & Small Businesses | Preview (macOS) or PDF24 Creator (Windows) | Zero cost, true removal, low learning curve; ideal for occasional contracts. |
| Legal & Compliance Teams | Adobe Acrobat Pro | Robust audit logs, batch redaction, built‑in sanitization meet GDPR, HIPAA, and FOIA standards. |
| IT & Security Professionals | PDF24 Creator (desktop) + command‑line verification | Scriptable workflow, no cloud exposure, integrates with SIEM pipelines for automated compliance reporting. |
| Academic & Research | Preview (macOS) or OCR‑plus‑redact combo (OCRmyPDF + Preview) | Handles scanned PDFs, low budget, preserves citation formatting while ensuring data privacy. |
Troubleshooting & Frequently Asked Questions
Redactions not fully removed?
Run pdftotext -layout redacted.pdf -. If hidden text appears, redo the redaction with a true redaction tool. In Preview, ensure you saved a new file rather than overwriting the original.
Metadata still visible?
Use Acrobat’s Sanitize Document feature or run exiftool -all= redacted.pdf to strip hidden fields.
PDF remains editable after redaction?
Some tools leave the file in an “editable” state. In Acrobat, choose File ▶ Save As ▶ PDF/A‑2b to lock the document.
Can redacted content be recovered?
If a true redaction tool was used, the data is removed from the file stream. Only backups or previous versions (e.g., Time Machine snapshots) could contain the original content.
Final Verdict: Redact a PDF Safely in 2026
Tool‑by‑tool summary
- Preview: Best free option for macOS users; suitable for single‑file jobs and quick turnarounds.
- Adobe Acrobat Pro: Gold standard for enterprises that need audit trails, batch processing, and built‑in sanitization.
- PDF24 Creator: Strong free desktop alternative for Windows, offering true removal and decent speed.
- Web‑based apps: Acceptable only for non‑confidential drafts; always verify with a copy‑paste test.
Next steps for organizations
1. Draft a written redaction SOP that references the regulatory caps listed above.
2. Train staff to verify each redaction with pdftotext or a similar tool.
3. Schedule quarterly audits of redacted archives and retain logs for at least six years.
4. Align your SOP with the GDPR, CCPA, and HIPAA requirements to avoid the fines described earlier.
Resources & further reading
- Adobe Acrobat Pro Redaction Guide (2026 edition)
- Apple Support: Use the Redact tool in Preview (Big Sur+)
- PDF24 Creator User Manual – Redaction Chapter
- iDox.ai AI‑redaction whitepaper (2026)
- European Data Protection Board – Guidelines on Data Sanitization (2025)
- California Attorney General – CCPA Enforcement Handbook (2026)
Verdict: For most professionals, Adobe Acrobat Pro delivers the most complete compliance package. macOS users who need a cost‑free solution should default to Preview, provided they follow the verification steps and metadata‑scrubbing recommendations outlined above.