PDF Redaction

Why this exists

Most "redaction" tools, including the redact feature in popular PDF editors, work by drawing an opaque rectangle on top of the offending text. The underlying text is still in the file. A few seconds in any PDF viewer with a "select text" tool, or a text-extraction utility, recovers the "redacted" content.

This has caused real-world leaks — court filings, medical records, and government documents — over and over again. PDF Redaction does not draw rectangles. It modifies the content stream itself.

How redaction works

• Text removal

  Text-showing operators whose glyphs intersect a redaction rectangle are deleted from the content stream. The deleted text never re-renders in any viewer and is not present in the raw stream.

• Image redaction at the bitmap level

  For JPEG and Flate-compressed image XObjects, the affected pixels are blacked out at the bitmap level. Cropping or re-decoding the image cannot recover redacted regions. For image formats we don't support partial-pixel redaction in (CMYK, 1-bit, Indexed), the whole image XObject is replaced with a solid black rectangle as a safe fallback.

• Form XObject recursion

  Redactions recurse into nested form XObjects with current-transformation-matrix tracking — so redactions placed on a page that references a shared letterhead or footer template apply to the template's content, not just the page.

• Verification on every save

  Every save re-opens the output, re-extracts text from the regions that were redacted, and confirms no characters remain. If verification fails, the save fails loudly rather than silently producing a leaky file.

Features

• Find and redact

  Search the whole document for a literal string or a regular expression and bulk-redact every match in one click.

• Manual redaction

  Draw redaction rectangles directly on any page. Move, resize, or delete individual redactions. Per-page and document-wide clear before save.

• Thumbnail navigation

  Sidebar of page thumbnails with redaction-count badges. Lazy-rendered so large documents stay fast.

• Keyboard-driven

  Arrow keys, Home/End, +/- for zoom, 0 to reset, F for fit-to-width, Delete to remove a selected redaction, Escape to deselect.

• Metadata-stripped saves

  Even with no redactions drawn, "Save copy" produces a sanitised version of the document with the metadata stripped — useful as a sanitization pass on its own.

Privacy

PDF Redaction makes one network connection on first launch to activate your licence key against the Whiteforge licence server. After that, it makes no further network connections. PDFs are processed entirely in memory and on the local disk. There are no analytics, no telemetry, no servers in the data path.

When you close a document or quit the app, the in-memory state is dropped; nothing is persisted to disk without your explicit "Save" action. See the privacy policy for full details.

Requirements

macOS 11 (Big Sur) or later. Apple Silicon (M-series) Macs. Distributed as a Developer ID signed and Apple-notarized disk image — not via the Mac App Store.

Support

For questions, bug reports, or feature requests, email support@whiteforgetech.co.uk.