Redacting a Document That Isn't a PDF Yet
A photo of a payslip. A screenshot of a chat. A letter that only exists on paper. Every redaction guide begins “open your PDF” — this one begins one step earlier, where the real privacy decision is usually made and usually missed.
Almost everything written about redaction assumes you are holding a PDF. The guides on this site argue about whether a box is in the right place, whether the text underneath survived, whether the version you attached was the version you meant. All of that starts after a document has been opened.
A large number of people never get that far. The bank statement is a photo taken on a phone because the branch handed over paper. The proof of address is a screenshot of an account page. The disciplinary letter arrived in the post. The form was filled in by hand and photographed on a kitchen table at eleven at night. The sensitive material is real, the obligation to cover part of it is real, and the file is a JPEG, a PNG, a HEIC or a sheet of A4.
This is a different problem from the ones the rest of the site solves, and it deserves its own treatment for one specific reason: the step where the document becomes a PDF is the step most likely to leak it. People are scrupulous about the redaction and careless about the conversion, which is exactly backwards — the conversion handles the complete, unredacted document, and the redaction only ever sees what the conversion produced.
What happens when you hand the tool something that isn't a PDF
Two different things, depending on how you offered the file, and the difference is worth knowing because it tells you whether the problem is the label or the contents.
If you click the drop zone and use the file picker, the picker is filtered to PDFs. Your photo is simply not in the list. Most desktop file dialogs let you widen that filter manually, and phone pickers behave differently again, so this is a speed bump rather than a wall.
If you drag the file onto the page instead, the filter does not apply and the file reaches the first check in the code. That check asks two questions — did your operating system report a type containing “pdf”, and does the filename end in .pdf — and if the answer to both is no, it stops there and writes Not a PDF file. into the status bar. Nothing is read, nothing is parsed, and nothing goes anywhere.
The trap is the obvious workaround. Rename IMG_4471.HEIC to statement.pdf and the first check is satisfied, so the file passes. The PDF engine then opens it, looks for the structure a PDF is required to have, finds image data instead, and the status bar changes to Failed to load PDF: followed by the parser's own complaint. That is the same distinction set out in why a PDF won't open in a browser redaction tool: the first message means your file was not offered as a PDF, the second means it is not one. A photo needs converting. There is no renaming shortcut.
Four routes to a PDF, ranked by what they do with your document
Specific menu labels move between operating system versions and application releases, so treat the descriptions below as patterns to look for rather than exact instructions.
- The system print dialog. Open the image, screenshot or document in whatever application already displays it, choose Print, and look in the destination list for an entry that saves to a PDF file rather than sending the job to hardware. Windows has shipped a print-to-PDF destination for years; the macOS print dialog carries a PDF menu with a save option. The rendering is done by your own machine's print subsystem. One caution: some destinations in that same list are cloud print services, which are not local at all, so pick the one that names a file, not a service.
- An export command in the application that owns the file. Word processors, spreadsheets, image editors and note applications installed on your computer almost all offer an export or save-as route to PDF, and for installed desktop software that conversion is local. The caveat is the browser-based versions of the same products: when the document already lives in a provider's service, the conversion happens there too, which may or may not matter depending on whether the provider already holds the document.
- A phone's built-in document scanner. Current mobile operating systems generally include a scanning feature in their notes or files application that detects the edges of a page, corrects the perspective and writes a multi-page PDF on the device. This is usually the best quality option for paper, because it de-skews and flattens the lighting in a way a plain photograph does not. Check where the output is saved: a scanner that writes into a synchronised folder has just copied the unredacted scan to a cloud account, however local the scan itself was.
- An online converter. This is the route to avoid, and the reason is timing rather than distrust of any particular site. A conversion website works by receiving your file; that transfer necessarily happens while the document is still complete and unredacted. Redacting locally afterwards does not undo it. If you have already used one for this document, the sensible response is to treat the original as disclosed and act accordingly, not to pretend the later redaction fixed it.
A quick heuristic for anything you are unsure about: local conversions keep working when the network is off. If a tool stops functioning the moment you disconnect, it was not doing the work on your machine.
The resolution ceiling that catches photographed pages
This one surprises people, and it is specific enough to plan around. It also explains why a redacted copy of a crisp photograph can come back looking soft.
When you download, every page is re-rendered at a fixed scale of two relative to that page's own dimensions in PDF points, your rectangles are painted on as solid black pixels, the result is encoded as a JPEG at quality 0.92, and the new page is written at the original point dimensions. Page geometry is preserved exactly — a Letter page stays a Letter page — but the pixel count is fixed by the page size, not by the source image.
Work it through. US Letter is 612 by 792 points, so the raster is 1224 by 1584 pixels: just under two megapixels, equivalent to about 144 dots per inch. A4 lands in much the same place. If your converter placed a twelve-megapixel photo onto a Letter-sized page, roughly five sixths of those pixels are discarded at export, and the first casualty is small print — account numbers, footnotes, handwritten annotations, the fine type at the bottom of a form.
The lever is at the conversion step. A PDF page that is physically larger in points is rasterized at proportionally more pixels, so if legibility matters, produce the PDF at a page size that suits the detail in the document rather than defaulting to Letter. Some converters go the other way and build a page whose point dimensions match the image's pixel dimensions, which produces an absurdly large nominal page but preserves detail; that is a legitimate choice as long as you know the printed result will need scaling. Either way, the check is the same and takes ten seconds: open the downloaded file and read the smallest text on the page at one hundred percent zoom.
What the conversion does and doesn't carry across
A photograph is not just pixels. It typically carries an EXIF block recording when it was taken, on what device, with what settings, and — if location services were on — where. That block is part of why a photographed document can be more revealing than the document itself.
The export produced here cannot carry any of it, and not because of a deliberate stripping step. Each page is drawn onto a blank canvas and the canvas is re-encoded as a new JPEG. A canvas holds pixels and nothing else, so there is no EXIF to carry. The output document is created empty and receives only the page images, with its title set to Redacted Document and its producer and creator set to HidePDF.
What this does not protect is every other copy. The original photograph is still in your camera roll with its metadata intact, and the intermediate PDF your converter produced may well have embedded the image complete with its EXIF. If that intermediate file is going anywhere other than straight into the redaction step — emailed to a colleague for a second opinion, saved to a shared drive, kept as the working copy — assume it carries everything the photograph carried.
One thing works in your favour. Because a photographed or scanned page has no text layer to begin with, the familiar failure where covered words remain selectable underneath a box cannot occur; there were never any words as far as the file is concerned. That is the scanned-document case described in redacting a scanned PDF versus a native PDF, and it means your verification burden is visual rather than forensic — which is a lower bar, but not a zero one.
Common mistakes and misconceptions
Renaming the file instead of converting it. Changing the extension changes a label. The bytes are still a photograph, and the parser says so a second later.
Being careful about the redaction and casual about the conversion. The conversion step is the one holding the complete document. If only one step in the chain gets your attention, it should be that one.
Assuming a local scan stays local. A phone scanner that writes into a synchronised folder has uploaded the unredacted scan as a side effect. Check the destination before you scan anything sensitive, not after.
Cropping the photo instead of covering the content. Cropping works only when the sensitive material happens to sit at an edge, and it quietly changes what the document appears to say by removing context. Where the material is in the middle of the page, a crop is not an option and an opaque box is.
Photographing paper at an angle in bad light. Skew and shadow survive conversion, then get sampled down at export. A built-in document scanner that corrects the perspective gives you a far better starting point than a hand-held snapshot, and costs the same amount of effort.
Treating a screenshot as if it were a safe extract. A screenshot of an account page captures everything visible, including the tab title, the account name in the corner, a notification banner and whatever the sidebar was showing. Review the whole frame, not the part you were interested in.
Deleting the original once the PDF exists. The converted PDF is a derived copy and the redacted export is derived again. If the covered material ever has to be narrowed or justified, you work from the earliest complete version you hold.
Expecting a photograph to behave like a document. The redacted output is a page image either way, so it will not be searchable, text will not be selectable, and anyone who needs to quote from it will be retyping. For a photographed source that is unavoidable, but it is worth telling your recipient rather than letting them discover it.
Related guides
Explore more ways to redact PDFs privately, or use the redaction tool above:
Frequently asked questions
I renamed my photo to .pdf and the tool still refused it. Why?
Because renaming changes the label, not the contents. The first check looks at the type your operating system reported for the file and at whether the name ends in .pdf, and it rejects the file with 'Not a PDF file.' when neither is true. Adding the extension by hand satisfies that check, so the file gets through — and then fails a moment later at the parsing stage instead, with a message beginning 'Failed to load PDF:'. That second failure is the PDF engine opening the bytes, looking for the structure a PDF is required to have, and finding the start of a JPEG. The two messages are genuinely different diagnoses: the first means your file was not offered as a PDF, the second means it is not one. A photo needs converting, not renaming, and the conversion has to produce a real PDF container with the image placed on a page.
Does converting my photo to a PDF first mean the image has been uploaded somewhere?
That depends entirely on which converter you used, and it is the single most important question on this page. A conversion performed by software already installed on your machine — a print dialog's PDF destination, a desktop application's export command, a phone's built-in document scanner — runs on your own hardware and produces a file on your own storage. A conversion performed by a website works by receiving your file, and that transfer happens while the document is still unredacted, which is the worst possible moment for it. The ordering trap is what makes this subtle: people are careful about the redaction step and casual about the conversion step, when the conversion step is the one handling the complete document. Check also where the output landed, because a phone scanner that saves into a synced folder has quietly copied the unredacted scan to a cloud account even though the scan itself was local. HidePDF's own side of this is separate and unchanged: once you have a PDF, it is read by code running in your browser tab and no upload is required at any point.
Will the redacted PDF still contain my photo's GPS location and camera details?
Not from the export produced here, because of how that export is built rather than because of any deliberate stripping step. Every page is drawn onto a blank canvas, your black rectangles are painted on top of those pixels, and the canvas is then encoded as a fresh JPEG at quality 0.92. A canvas holds pixels and nothing else, so the EXIF block that carried the location, the timestamp, the camera model and the lens settings has no route into the encoded image. The new document is created empty and receives only those page images, with the title set to 'Redacted Document' and the producer and creator set to 'HidePDF'. The caveat is about every other copy, not this one: the original photo still sits in your camera roll with its EXIF intact, and the intermediate PDF your converter produced may well carry the image through with its metadata attached. If that intermediate file goes anywhere other than into the redaction step, treat it as carrying everything the photo carried.
My photo was sharp but the redacted page looks soft. What happened?
You hit a resolution ceiling that is set by the page size of the PDF, not by the quality of your photograph. The export re-renders each page at a fixed scale of two relative to the page's own dimensions in PDF points, and then writes the new page at those original point dimensions. A US Letter page measures 612 by 792 points, so it is rasterized at 1224 by 1584 pixels — a little under two megapixels, or roughly 144 dots per inch. A twelve-megapixel phone photo placed on a Letter-sized page is therefore reduced to about a sixth of its pixel count, and small print is the first thing to go. The fix is at the conversion step, not the redaction step: produce a PDF whose page is physically larger in points, and the raster gets proportionally larger too. Before you send anything, open the downloaded file and read the smallest text on the page at one hundred percent zoom, because that is what your recipient will be looking at.