Redacting Numbers in a PDF: When the Totals Give Them Away
A black box can be completely permanent and still fail to hide a number. If the figure you covered is part of a sum that is still printed on the page, a reader does not need to defeat the redaction — they can just do the subtraction.
Nearly every redaction failure written about on this site is a failure of the mark itself. The box was a drawing sitting on top of live text. The OCR layer survived underneath. The metadata still named the author. In all of those cases the fix is technical, and a tool that burns redactions in permanently solves the problem outright.
This page is about a failure that no tool solves, because nothing went wrong with the redaction. The mark is opaque, the pixels underneath are destroyed, the file would pass any verification you ran on it — and the number is still readable, because it can be reconstructed from figures you deliberately left on the page. The leak is not in the file. It is in the arithmetic.
This matters disproportionately for the documents people most often bring to a redaction tool: bank statements, pay stubs, invoices, budgets, P&Ls, expense claims, settlement schedules, headcount tables. Those documents are built out of numbers that add up, and a document whose numbers add up is a document that answers questions you did not intend to answer.
How a covered number gets recomputed
There are four common routes, and they all rely on nothing more exotic than a calculator.
A single covered cell in a column with a visible total. This is the classic case and the most common. A five-line expense table with a printed total, one line blacked out, four lines visible: the covered figure is the total minus the other four. It is exact, it takes ten seconds, and it works no matter how good your redaction was. One unknown in a solved equation is not an unknown.
Cross-footing in a grid. Tables that total both down the columns and across the rows give the reader two equations per cell. Covering one cell in a cross-footed grid is almost never enough — even when you also cover the column total, the row total may still pin the value down, and vice versa. This is why financial statements and departmental budgets are unusually leaky: the whole design of the document is redundant arithmetic.
Differences between subtotals. Documents that present a running balance, a carried-forward figure, or a before-and-after subtotal hand the reader a difference. If the opening balance, the closing balance, and every transaction but one are visible, the missing transaction is the gap. The same applies to a "total compensation" line sitting above base salary, bonus, and a redacted third component.
Bounding rather than solving. Even when the exact value cannot be recovered, partial arithmetic usually narrows it. If two of four line items are covered but the total is printed, the reader knows their sum, which means neither can exceed it and each can be bracketed. Percentages do this too: a redacted figure described elsewhere as "roughly a third of the total" is not redacted in any meaningful sense. For salaries, settlements, and medical costs, a tight range is often just as sensitive as the exact number — the harm you were avoiding rarely depends on the last two digits.
A check to run before you export
The whole check happens before you draw the last box, and it is much shorter than it sounds, because most documents repeat their important figures in a small number of predictable places.
- List the values you are covering, not the boxes you drew. Work from the figures themselves. A single value may appear in four places in a long document, and the goal is to account for the value, not the rectangle.
- For each value, find the arithmetic it participates in. Which column total includes it? Which row total? Which subtotal, running balance, or grand total? Which percentage or ratio is calculated from it? Write these down next to the value.
- Count the unknowns in each of those lines. If a line of arithmetic is visible and contains exactly one covered value, it is solved. You need a second unknown in that line before it stops being solved.
- Choose your second unknown deliberately. Either cover the total as well, or cover a second line item. Covering the total is the stronger protection but often removes the figure the recipient actually needed, which is its own kind of failure. Covering a second item preserves the total but hides something that may not have been sensitive on its own. Neither choice is automatically right — but making it on purpose is very different from discovering afterwards that you made it by accident.
- Sweep the narrative and the summary pages. Tables get careful attention; prose does not. A sentence reading "the settlement of $X was paid in March" or "headcount fell by twelve" restates the redacted figure in words, and cover pages, executive summaries, and appendices are frequently generated from the same underlying data as the table you were careful with.
- Check charts, labels, and axes. A bar chart with a data label, or even a plotted bar against a labelled axis, can reproduce a redacted figure to within a few per cent. Charts are pictures of the data, and the data is what you were trying to withhold.
- Check across the whole production, not just this file. If you are sending several documents, a figure covered in one and visible in another is not covered. The same goes for a version you sent last month, an earlier draft, or a spreadsheet attached to the same email.
One more structural case is worth naming: redacting a row rather than a value. Removing an entire line item from a table still leaves the line's contribution visible in the total, and the number of remaining rows tells the reader that something was removed and roughly what size it was. Covering a whole row does not make the arithmetic go away — it just makes the missing piece more obvious.
What this tool does and does not do here
HidePDF draws manual boxes and nothing else. It does not read, search, parse, or interpret the contents of your PDF, and it has no concept of a table, a column, a total, or a number. It cannot find sensitive figures for you, it cannot warn you that a covered cell is recoverable from a visible total, and it will not stop you from exporting a document whose arithmetic still answers the question. Every judgement on this page is yours to make before you click download.
What the tool does handle is the part that is purely mechanical. When you export, it rebuilds every page of the file as an image at a fixed higher resolution and burns your boxes into those images, which is what makes the covered pixels genuinely unrecoverable rather than hidden beneath a shape that can be moved or deleted. All of that work happens inside your browser — the PDF is processed on your own device, with no upload required. The trade-off of the image-based approach is that the exported document is no longer selectable or searchable text anywhere, including the parts you kept, so decide before exporting whether your recipient needs to search the file.
Common mistakes and misconceptions
"The redaction is permanent, so the number is safe." Permanence and secrecy are different properties. Permanence means the covered pixels cannot be recovered from the file. Secrecy means the value cannot be worked out at all. A perfectly permanent redaction of a value that is implied elsewhere on the page protects nothing.
Trusting a verification step to catch it. Checking that text cannot be copied out from under the box, or that the file has no leftover text layer, is a worthwhile check and it will pass cleanly here. Arithmetic recovery is invisible to every technical test, because there is nothing technically wrong with the document.
Assuming rounded or approximate figures are safe. A total printed to the nearest thousand still constrains the covered value to a range of a thousand. That is not protection for most of the things people redact.
Forgetting the count. In tables about people — payroll, headcount, claims, incidents — the number of rows is itself data. Covering the names in a five-row table still discloses that there were five, and in a small organisation that can identify everyone in it.
Covering the total instead of thinking about it. The over-correction is real. Blacking out every total in a financial statement usually destroys the document's purpose — the recipient asked for it to verify a figure — and it invites the request to come back unredacted. The goal is a second unknown, not a wall of black.
Redacting one document in a set consistently with itself but not with the others. Consistency across a production is a separate discipline from getting one file right, and arithmetic recovery is one of the ways an inconsistent set betrays itself.
Treating small numbers as harmless because they are small. A single-digit figure in a cell can be the most identifying thing in a table, particularly when it counts people.
Related guides
Explore more ways to redact PDFs privately, or use the redaction tool above:
Frequently asked questions
If a number is blacked out, can someone really work out what it was?
Often yes, and it does not require any attack on the file. If the covered value sits in a line of arithmetic that is still visible — a column with a printed total, a row that sums across, a subtotal and a grand total that differ by exactly the missing amount — then anyone with a calculator can recover it exactly. Where only part of the arithmetic survives, a reader can usually still bracket the value within a narrow range, which for a salary, a settlement, or a balance is frequently as damaging as the exact figure. This has nothing to do with whether the redaction itself is permanent. The box can be burned into the page and completely unrecoverable, and the number still leaks, because it was never only in that one place.
Do I have to redact the total as well?
Not always, but you have to check. The rule of thumb is that a single covered cell in a visible line of arithmetic is recoverable, so you need at least one more unknown in that same line. That second unknown can be another cell you also cover, or it can be the total itself. Which one you pick is a judgement call: covering the total protects the number but often removes the very figure the recipient needed, while covering a second line item keeps the total readable at the cost of hiding something that may not have been sensitive on its own. Where a rule, an order, or a records procedure governs what you must disclose, that rule decides it rather than convenience.
How do I check a long document for this without recomputing everything?
Work from your list of redactions rather than from the pages. For each value you covered, ask where else that number is expressed — a total, a subtotal, a carried-forward balance, a percentage, a chart label, a sentence in the narrative, a summary page at the front, an appendix at the back. Most documents repeat their key figures in a small number of predictable places, so the check is usually a handful of lookups per redacted value rather than a full audit. The two places people forget are the narrative text that restates a figure in words and the summary or cover page, which is often generated from the same data and sits before anyone reaches the table you were careful with.
Does HidePDF find totals or flag recoverable numbers for me?
No. HidePDF does not read, search, or interpret the contents of your PDF — you draw the boxes yourself, by hand, over whatever you decide needs covering, and the tool covers exactly that region and nothing more. It has no notion of a table, a column, or a total, so the arithmetic check described on this page is entirely a human step you do before you export. What the tool does handle is permanence: on download it rebuilds every page of the file as an image with your boxes burned in, so the covered pixels are genuinely gone rather than hidden under a shape. All of that happens in your browser, with no upload required.