Can You Copy-Paste Text Out of a Redacted PDF?
In many files that look redacted, the answer is yes. A black box is often a drawing on top of a still-live text layer. Select, copy, paste — the secret is in the clipboard. Permanent redaction has to destroy that object, not hide it.
The most common PDF “redaction” failure is not a faint marker or a missed page. It is a convincing black rectangle over letters that are still in the file as text. You can look at the page and believe the Social Security number is gone. You can then drag the cursor through the bar, copy, and paste the number into an email. Search finds it. Screen readers can still speak it. That is not a rare corner case. It is how PDF is built: appearance and text are different objects, and many tools only change appearance.
The longer distinction between paint and removal is permanent PDF redaction vs visual redaction. A checklist for proving a given export is clean is how to verify a PDF is redacted. This page is the copy-paste failure itself: why the text layer survives, how to demonstrate it in thirty seconds, and what has to happen to the file so paste returns nothing.
How a PDF can show black and still hold the letters
A page content stream is a program: it paints glyphs with operators such as Tj and TJ, draws paths, and places images. A highlighter, a sticky note, a “comment” shape, or a filled rectangle added in Preview, a browser viewer, or Word-as-PDF is often a second drawing — sometimes an annotation that is not even in the same content stream. Viewers composite the rectangle on top. Human eyes see black. The original text operators are still there. Hit-testing for selection walks the text objects. Your selection never needed to “see through” the ink; the ink was never the text.
Some tools add an opaque image XObject over the region but leave the text underneath. Flattening that is not automatic. Other tools rasterize the whole page but then run OCR and attach a new hidden text layer — recreating searchability, including over the “redacted” band if OCR reads bleed or if the band was only on the image and the old text was merged back. Print-and-scan folklore collides with this: a new OCR pass can put the secret back as text even when the pixels look marked.
Encryption and permissions (“no copy”) are not redaction. A permission flag is a viewer courtesy. It does not delete operators. Anyone with a tool that ignores the flag, or a reader that extracts strings, still has the characters.
How to test for a live text layer in under a minute
Open the file you would actually send
Not the editor session — the export, the attachment, the Drive object. If you only look at the in-progress canvas, you are not testing the artifact.
Select through the black
Click in the “redacted” band and drag. If a highlight appears and characters land on the clipboard, the text object is live. Paste into a plain text editor so you are not looking at a styled preview.
Search the whole document
Find a distinctive string that should be gone (a name, a nine-digit pattern, an account fragment). Search can hit text that is hard to select because it is rotated, in a table, or in a header. One successful hit is a failed redaction.
Try select-all on a “clean” page
Paste the dump into a notepad and skim. Secrets hide in footers, in tiny type, and in form fields (a separate problem on the fillable-form page in this batch).
What true redaction has to do to the text object
Removal means the characters are not in the content stream (or in a hidden text layer, or in an alternate image that still encodes them). Strategies differ: delete the text operators and fill the area; rasterize the page to an image so glyphs become pixels and then black those pixels; rewrite the page with pdf libraries that strip text in the bounding box. HidePDF’s burn-in is the rasterize-and-cover path: marked boxes become part of a flattened page image in the export, so the usual select-and-paste test should fail on those regions. That is the same family of guarantee as burning a box into a photograph. It is not the same as stacking a comment.
After export, run the tests above on that file. Tools can fail. Pages can be skipped. A second text layer can exist outside the box you drew. Verification is how you know this PDF, not a theory about PDFs, is safe to send. The verify guide walks more failure modes (including search and metadata). Use this page’s tests as the copy-paste core: if paste works, stop. Do not send it. Enlarge the region or re-run burn-in. Do not add a second rectangle “to be sure” on a file that still has live text — two drawings on live text is still live text.
Where this shows up in real files
A contract “redacted” in a Mac Preview rectangle. Recipients with Acrobat or a browser extract the fee, the SSN, the home address. The sender saw black. The file had letters.
A Word document with a black highlighting pass, exported to PDF. Highlight is a character style or a drawing. PDF export often keeps the text. Search finds the salary.
A scanned statement with a black box drawn in a markup app, then “saved.” If the save wrote annotations instead of a new image-only page, the OCR layer from the scan is still there. Search finds the account number that the box covered visually.
A page that looks image-only but still pastes text. An invisible text layer was added for accessibility or search. It is a feature until it duplicates a secret you thought was only in pixels.
How to use HidePDF when the threat is copy-paste
- Open the PDF in the tool above from local storage. Draw boxes over every region that must not remain as text or as readable pixels.
- Download the burned-in export. Close the working session.
- In a desktop reader, try to select through each box. Search for strings that must be gone. If anything hits, the job is not done — return to the tool with a larger box or a missed page.
- Send only the export that failed those extraction tests. Keep the original offline if you still need an unmarked master.
If you need the conceptual split (paint vs destroy) in more depth, use permanent vs visual redaction. If you need a broader verification list, use how to verify a PDF is redacted. Stay here until you have actually tried paste on the file in your hand.
Mistakes that leave a clipboard full of secrets
Trusting that black looks final. Test paste. Appearance is not the text layer.
Redacting in a previewer and emailing that same file. Many previewer marks are comments. Burn in, then test.
Searching only page 1. Headers repeat. So do SSNs in footers.
Confusing “copy disabled” with “text deleted.” Permissions are not removal.
Skipping search because select did not work on a scanned image. If there is OCR, search can still hit. If there is no text layer, pixels can still be readable — that is a zoom problem, not a paste problem, and it still matters.
Related guides
Explore more ways to redact PDFs privately, or use the redaction tool above:
Frequently asked questions
Why can I still select text under a black box?
PDF pages are stacks of objects: text runs, images, and vector drawings. A rectangle you added in a previewer is often an annotation or a new drawing sitting above the original text. The letters remain in the content stream. Selection tools hit the text, not the paint.
How do I test a file I was told was redacted?
Open it in a desktop reader. Drag a selection through the black region. Paste into a blank notepad. Search (Ctrl+F / Cmd+F) for a string you believe is hidden. If it appears, the box was cover, not removal. Repeat on every page that should be clean.
Does HidePDF leave a selectable text layer under the box?
HidePDF burns marked regions into a flattened page image for the export. The goal of that burn-in is that the hidden string is no longer a text object you can copy. Always search the download anyway — verification is part of the job, not a substitute for the tool.
Does HidePDF send the PDF to a server to strip text?
No. The file is processed in local browser memory on this page. Nothing is sent to HidePDF for redaction.