How to verify destructive PDF redaction instead of trusting a black box

Why an overlay can fail

PDF pages can contain selectable text, vector shapes, images, annotations, optional layers, forms, and attachments. Placing a black rectangle above one object may leave the original object intact below it.

A recipient may be able to select the covered text, remove the overlay, search the document, inspect comments, or extract content with another parser. Appearance alone is therefore an incomplete test.

What rasterizing a marked page changes

The marked page is rendered to pixels, the rectangles are burned into that image, and a new page is built from the flattened result. The original text and vector objects from that marked page are not copied into the new page content stream.

The tradeoff is substantial: text search and selection disappear, accessibility is reduced, links and forms are lost, and image resolution controls quality and file size. Unmarked pages remain original PDF pages and need their own review.

Mark context, not only characters

Extend a mark beyond the complete glyphs and examine nearby context. A column heading, repeated account suffix, filename, date, or page header can identify information even after the obvious value is covered.

Inspect every page and every occurrence. The tool does not detect names or numbers, and it cannot decide what a disclosure rule considers identifying.

Try to break the result before sharing it

Search for each removed phrase, drag a selection across the area, copy page text, inspect properties, list attachments, and open the file in a second viewer. Zoom into every edge of every mark.

For regulated, legal, medical, or high-consequence disclosure, combine these checks with the organization's approved redaction process. A browser tool cannot certify compliance for every document or jurisdiction.

Check the information around every covered area

Removing the selected pixels is only one part of disclosure review. File names, running headers, page numbers, repeated identifiers, bookmarks, attachment names, comments, and nearby context can reveal the same fact indirectly. A remaining sentence may identify a person even when the name is gone. Review the document once as a technical file and again as a reader who is actively trying to infer the removed information. If the consequence of disclosure is high, have a second person compare the exported copy with a written removal list and the organization’s approved process before release.

What the browser does

PDF.js renders marked pages at approximately 2.5 times the page scale. The redaction rectangles are painted into the canvas. PDF-lib then creates a fresh page containing that raster image.

Rasterization removes the marked page's original selectable text and vector content from the exported page, but it also changes quality, accessibility, searchability, forms, links, and file size. Unmarked pages retain their original PDF content streams.

Inputs and outputs

• Input: a PDF that PDF.js can render.
• Marks: rectangular regions drawn on page previews.
• Output: a PDF with rasterized marked pages and copied unmarked pages.

Verification checklist

• Search the exported PDF for every removed name, number, and phrase.
• Attempt to select or copy text from each rasterized page.
• Inspect metadata, attachments, comments, and unmarked pages independently; redaction marks do not clean them.

Troubleshooting

• If text appears outside a box, enlarge the mark and export again.
• If a page looks soft, compare the output at normal reading zoom; rasterization trades editability for destructive flattening.
• If the PDF contains forms, signatures, layers, or attachments, use a dedicated PDF security workflow and inspect those objects separately.