Caviar

How to redact a PDF on Mac, for good

Three ways to redact a PDF on a Mac: Preview, Adobe Acrobat and Caviar. What each one really does to the file, what it lets through, and how to check the result before you send it.

Redacting means removing a piece of information from a document for good, not hiding it. The difference matters because a PDF is not a sheet of paper: it stacks text, fonts, images, annotations, metadata, sometimes attachments or earlier versions. A box drawn on top is one more layer. The text underneath stays in the file, and selecting, copying or searching it is enough to read it. Why black boxes fail goes through the three ways a redaction leaks.

A successful redaction meets three conditions: the text under the area no longer exists in the file, hidden data has been removed, and the result has been checked afterwards rather than assumed.

Since macOS Big Sur (2020), Preview has a real redaction tool, separate from the shapes in the markup toolbar.

  1. Open the PDF in Preview, then View › Show Markup Toolbar.
  2. Pick the Redact tool (in the toolbar, or in the Tools menu). Preview warns that redacted content is permanently removed.
  3. Drag over the text to redact: a black box crossed with an X appears. Repeat for every passage, on every page.
  4. Save (⌘S). The text is removed when you save.

What it really does. The text under the box is removed from the file, not just covered. In a test published in December 2020 (The Eclectic Light Company), a few letter fragments nevertheless stayed visible at the right edge of the box, and text running past the page edge, invisible on screen, was not removed at all; Acrobat's Sanitize tool recovered both.

What Preview does not do. It removes neither metadata (title, author, keywords), nor attachments, nor the recognized-text layer of a scan, nor anything outside the page. It detects nothing: finding every occurrence is up to you. It checks nothing after saving. And the most common trap: a box drawn with the Shapes tool is not a redaction, it is a drawing laid over intact text.

For one address on one page, with the checks at the end of this guide, Preview is often enough. For a twenty-page file or a document you are liable for, it is not.

Acrobat Pro (subscription) is the reference in law and accounting firms, with two tools to use one after the other.

  1. Tools › Redact. Mark passages by hand, or use “Find Text & Redact” for every instance of a word or pattern.
  2. Click Apply: this is when the text is removed. Until then, the marks are only annotations.
  3. Still in Redact, run Sanitize Document: it removes metadata, attachments, bookmarks, hidden text and hidden layers.
  4. Save under a new name and read the resulting file.

What it really does. Used properly, Acrobat removes the text and the hidden data. Two limits remain. The first is human: skip “Apply” or “Sanitize” and you send annotations laid over intact text, and the screen shows no difference. The second is technical: a study published in 2023 in PoPETs showed that eleven redaction tools, Acrobat included, left in the file the exact positions of the characters around the removed area, and that these tiny shifts were enough to recover redacted first and last names in hundreds of official documents.

Caviar approaches the problem differently: rather than removing text from a file that keeps its structure, it replaces every page with an image.

  1. Open the PDF in Caviar (or, in the Finder, right-click › Open With › Caviar). Detection starts: names, addresses, emails, phone numbers, IBANs, identity numbers, faces, signatures, barcodes, and depending on the Mac's region the social security, tax and license plate numbers of some thirty countries.
  2. Review the suggestions (⌘F): one key to accept, one to reject. For an area detection missed, drag it with the mouse, like a selection rectangle.
  3. Export (⌘E). Caviar re-renders every page as a 300 dpi image into a new document, areas included, then checks pixel by pixel that every area is black. If a single one is not, it refuses to write the file.

What it really does. The delivered file contains no text at all, neither under the areas nor elsewhere, so there are no character positions left to exploit: only the width of the box remains, as on a photocopy. Nothing travels from the original to the delivered document: no font, no text stream, no off-page content. Metadata, attachments, scripts and earlier versions are not copied. And the check is not an option: it is what allows the file to be written.

What it does not do. The resulting PDF can no longer be selected or searched, since it contains no text; that is intended, but it is not suitable when the recipient needs to copy passages. The file is larger. Detection suggests, it does not decide: always read the document before sending it. And no tool protects against what context reveals: a single blacked-out word in the middle of a sentence can sometimes be guessed.

Everything happens on the Mac. Caviar has no network entitlement in its sandbox: the document cannot leave your machine, and that is more than a promise.

Five minutes, with tools already on your Mac. Do it on the file you are about to send, not the one open in the editor.

  1. Copy and paste. Open the file in Preview, ⌘A then ⌘C, and paste into TextEdit. Nothing redacted should appear. If the paste is empty, the file no longer contains text: good news for a redaction, bad news for a form the recipient has to fill in.
  2. Search. Still in Preview, ⌘F and type a word you redacted. Zero results expected.
  3. Metadata. Tools › Show Inspector (⌘I), Info tab: title, author, subject, keywords. A person's or client's name often hides there.
  4. Bookmarks and attachments. View › Table of Contents for bookmarks. Preview does not show attachments; if the original had any, open the result in a reader that does (Acrobat Reader, Attachments panel).
  5. The edges. Zoom to 400% on every box: no letter fragment should stick out.
  6. No blur. If a passage was blurred or pixelated instead of blacked out, start over: blur and pixelation can be undone (Unredacter, 2022).

Caviar runs checks 1, 2, 3 and 5 itself, before writing the file. Doing them once by hand shows what they are for.

Is a black box in Preview enough to redact a PDF?

Only if it comes from the Redact tool (since macOS Big Sur), not from the Shapes tool. Even then, Preview removes neither metadata, nor attachments, nor off-page text, and checks nothing: copy and paste the result into TextEdit to verify.

How do I redact a scanned PDF on Mac?

On a scan, the text is an image, sometimes doubled by an invisible recognized-text layer. You need to cover the area in the image and remove that layer. Caviar recognizes the text of scanned pages on the Mac, suggests the areas, then re-renders the page: the hidden layer does not make it into the result.

What happens to the PDF's metadata?

Preview leaves it. Acrobat removes it if you run “Sanitize Document”. Caviar does not copy it into the delivered document: title, author, keywords, XMP data, attachments, scripts and history stay in the original.

Can blurred or pixelated text be recovered?

Often, yes. Pixelation keeps the average colour of each block, and public tools (Depix in 2020, Unredacter in 2022) reconstruct the text by comparing candidate renderings to the image. Always redact with solid black.

Is the redacted PDF still readable and printable?

Yes. With Caviar, every page is a 300 dpi image, sharp on screen and on paper. The text can no longer be selected, which is the point. The file is larger than a text PDF.

Is my document sent anywhere during redaction?

With an online service, yes, by definition. With Preview and Acrobat, not in principle. With Caviar, not by construction: the app has no network entitlement and detection uses Apple's frameworks on the Mac.

Coming soon to the Mac App Store

Caviar is free during launch. See the overview.