CaviarWhy black boxes fail
A PDF is not a sheet of paper. What the screen shows is one layer among others, and the black box you draw is one more. Here are the three ways a redaction leaks, the cases where it showed, and what it takes to truly destroy text.
1. The text is covered, not removed
This is the most common case and the easiest to exploit. In most PDF editors, and in every word processor that exports to PDF, a black box is a shape laid over text that stays whole in the file. Selecting the area, copying and pasting into a text editor is enough to read it; a search (⌘F) finds it too. Black highlighting in a word processor, Preview's Shapes tool, the annotation of an online editor: they all work this way.
2. Blur and pixelation can be undone
Blurring or pixelating looks more discreet than a box. Mostly, it is less safe. Pixelation replaces each block with its average colour, and that average depends on the letters that were there. In 2020 the Depix tool showed the way back from mosaic to text; in 2022 Unredacter (Bishop Fox) solved a public challenge by rendering candidate letters in the same font and comparing the resulting blocks to the image. Its author's advice fits in one sentence: solid black bars only, never blur.
3. The text is removed, but not its place
The subtlest case concerns tools that appear to do the right thing. When a tool removes the characters under the box but leaves the rest of the line intact, the file keeps the exact position, to a thousandth of a point, of every neighbouring character. A layout engine adjusts those positions according to the word before. A study published in 2023 in PoPETs (Bland, Iyer and Levchenko) used these shifts to recover redacted first and last names, found the flaw in all eleven tools examined, Adobe Acrobat included, and de-redacted hundreds of real documents, including inspector general reports and freedom-of-information responses.
And what you cannot see
A PDF also carries what is not displayed: metadata (author, title, keywords, software), attachments, bookmarks, annotations, the recognized-text layer behind a scan, and sometimes earlier versions of the document, saved one after the other in the same file. A careful redaction of the page leaves all of that intact.
| Year | Who | What happened |
|---|---|---|
| 2008 | US federal courts (PACER) | An audit finds 1,600 filings with readable Social Security numbers; a 2011 study will estimate the cases at thousands, perhaps tens of thousands. |
| 2011 | Apple v. Samsung | The redacted passages of a federal judge's ruling can be read by copy and paste; the court pulls the opinion and posts a new version within hours. |
| 2014 | New York Times | A CIA presentation is published with redactions that highlight, copy and paste are enough to lift. |
| 2016 | Federal court, Washington D.C. | A party's name, meant to be redacted in an order, is visible under the boxes; the judge orders an investigation and a new version is posted. |
| 2019 | Paul Manafort's lawyers | Black boxes laid over live text: copy and paste reveals a meeting in Madrid and the sharing of polling data. The pleadings are pulled and refiled. |
These five cases are reported in “Embarrassing Redaction Failures”, Judge Herbert B. Dixon Jr., Judges' Journal of the American Bar Association, 2019.
The common thread: professionals, expensive tools, and nobody who tested the file before sending it. The same causes produce the same effects in an accounting firm, an HR department or a real-estate agency, with fewer journalists around to notice.
- The text under the area no longer exists in the file, not just on screen.
- Character positions are no longer stored, so the gap left behind says nothing beyond its width.
- Hidden data is removed: metadata, attachments, bookmarks, scripts, text layers, earlier versions.
- The result is checked afterwards, on the file produced, not assumed from what the tool displays.
- The document never leaves the machine during the operation: an online service that “protects” your data starts by receiving it.
Caviar does not edit the original PDF. On export, it re-renders every page, whether it carries an area or not, as a 300 dpi image into a new document, and paints the areas black in the image. So there is no text left in the delivered file, neither under the areas nor elsewhere, no character positions, no fonts, no off-page content. Metadata, XMP data, attachments, scripts, annotations and earlier versions are not copied.
Before writing the file, Caviar reopens the result and checks, pixel by pixel, that every area is black. If one is not, the export is refused and no file is written. It is the one “option” that cannot be turned off.
Detection (names, addresses, IBANs, identity numbers from some thirty countries, faces, signatures, barcodes) uses Apple's frameworks and runs on the Mac. The app has no network entitlement: the document cannot get out.
The price is known: the resulting PDF can no longer be selected or searched, and it is larger. For a document you are redacting, that is exactly what you want. And no tool protects against context: a single blacked-out word in the middle of a sentence can sometimes be guessed, and it is up to the proofreading to catch it.
The guide How to redact a PDF on Mac compares Preview, Acrobat and Caviar step by step, and lists the checks to run on any file.
- Herbert B. Dixon Jr., “Embarrassing Redaction Failures”, Judges' Journal, American Bar Association, 2019.
- Maxwell Bland, Anushya Iyer, Kirill Levchenko, “Story Beyond the Eye: Glyph Positions Break PDF Text Redaction”, Proceedings on Privacy Enhancing Technologies, 2023.
- Dan Petro (Bishop Fox), Unredacter, 2022; reported in ITPro.
- Howard Oakley, “How effective and safe is Preview's redaction tool?”, The Eclectic Light Company, 2020.
- Glenn Fleishman, “How to redact text in a PDF with the Preview app, Adobe Acrobat and PDFpen”, Macworld, 2024.
Caviar is free during launch. See the overview.