A black box erases nothing
Drawing a black rectangle over a name, in a PDF viewer, does not remove the name. It is still written in the file, underneath the rectangle, and it comes back with the first copy and paste.
The copy-paste test
A black box drawn over it
What a copy-paste returns
Name: Jean Dupont, born 3 May
Redacted: the characters removed
What a copy-paste returns
Name: , born 3 May
The two pages look identical down to the pixel. Only copy-paste tells them apart, and you can try it here. Select the left-hand line, box included, and paste it elsewhere.
The same test on a real PDF. Both files hold the same fictional document: blacked out with boxes in the first, redacted by Atelier Docs in the second. Open them, select a black area, copy, paste.
What a black box actually does
A PDF is not a picture of a page: it is a list of drawing instructions. Writing “Dupont” and then drawing a black rectangle at the same coordinates gives two successive instructions, not a correction of the first. The reader carries them out in order and shows you the rectangle. The string “Dupont” has not moved from the content stream. Anything that reads the file instead of looking at it finds it again: a copy and paste, a text extractor, a search index, a screen reader.
Checking takes ten seconds
Open the document, select the blacked-out area with the mouse as if you wanted to read it, copy, paste into a text editor. If the text appears, it was never removed. The test works on any document you receive, including from a public body or a professional firm, and it needs no tool at all. An empty result does not prove everything, but a full one settles the question.
Remove the glyphs, not the line
Genuinely removing a word means taking it out of the stream, character by character. Done naively, everything after it on the same line shifts: “Name: Jean Dupont, born 3 May” would become “Name: , born 3 May” with the end of the line pulled back by several centimetres, which shows and gives the cut away. The advance of each removed glyph therefore has to be given back as an exactly equivalent kerning offset, so that the rest of the line does not move by a single point.
The text that is not in the page
Three places escape the page stream and get forgotten. Annotations first: a comment, a link, a tooltip carry their own text, and a tooltip is enough to reveal what a black box was covering. Flattened forms next: their values are not in the page but in objects called separately, so a treatment that stops at the stream leaves intact exactly what it came to remove. Images last: a name legible on a scan is made of pixels, and only blacking out those pixels removes it.
What redaction does not cover
Three things remain, and they are worth knowing. The title, author and keywords stored in the document properties are not page content: they are cleaned with the Metadata tool. A signed document loses its signature as soon as it is modified, redaction included, which is what a signature is meant to do rather than a flaw. And cropping erases no more than a black box: matter outside the frame stops being displayed but stays written in the file.
Redact a document
The tool removes the glyphs from the stream, descends into form objects, deletes annotations and blacks out image pixels. The filled rectangle goes on last, not to hide anything since there is nothing left to hide, but so that a redacted document looks redacted: a blank gap reads as a badly printed page. It all happens in your browser, the document is not uploaded.