Can someone read what sits under a black box in a PDF?

You have a blacked-out file and a deadline

Picture a parish council clerk on a Thursday afternoon. A colleague has sent over planning-objections-redacted.pdf, 14 pages, with residents' names and phone numbers hidden behind black bars. It has to go on the council website before Friday's meeting. The clerk did not make those bars and has no idea which program drew them.

That is the usual position: the black bars look solid, the person who added them believes the job is done, and nobody has asked whether the hidden words actually left the file. On screen, a real redaction and a cosmetic one are identical. The difference only shows up when someone tries to get at the text.

A two-minute test in any PDF reader

Use the copy you are about to send or publish, not an earlier draft sitting in the same folder.

• Click and drag across one of the bars, copy, and paste into a plain text editor. Words appearing there means the box hides nothing.
• Open the reader's search box and type a name or number you expect to be blacked out. A match inside a bar is a leak.
• Open the file in a second program, such as a browser tab. Some leaks show up in one reader and not in another.
• Look at the document properties for an author, a title or a company name the bars were meant to hide.
• Zoom to 400 percent on each bar and look for grey edges, letters peeking out or a box that does not quite cover the line.

A failed test is conclusive. A passed test only means these particular attempts found nothing.

Which kinds of black box give the words back

The last row is the only real redaction. Everything above it changes what you see, not what the file contains.

Running the check in PDFGym

1. Open the redaction checker; it works inside this browser tab and does not upload the file.
2. Choose the exact PDF you plan to share, or drop it onto the page.
3. Press the check button and wait while each page is read.
4. Read the counts at the top: pages inspected, dark cover boxes found and boxes with live text below them.
5. Scroll through the page evidence. Any leaking box is outlined and the text recovered from under it is printed in full.
6. Finish with the list of other places to review: document properties, attachments, comment text and hidden layers.

The checker only reads. Your file is not modified, so you can run it as often as you like.

Reading the report without over-trusting it

The cover scan looks at the page's own drawing instructions for filled rectangles that are dark and nearly opaque. When selectable text sits mostly inside one of those rectangles, the box is flagged and the text shown. A mid-grey bar or a see-through tint does not count as a cover, so it will not be outlined even if it hides something.

Three blind spots matter. A black box added as a comment-style markup lives outside the page drawing, so it is not outlined; the report does list comment text, but drag across such a box yourself. Words that exist only as pixels in a scan have no text to recover, so a scanned page needs a close visual look instead. And a cover built from an odd clipping path or many slivers may not read as a rectangle. "No leak found" means these checks came up empty, nothing more.

Errors that make a leak look fixed

Adding a thicker or second bar. More ink on top changes nothing underneath. Go back to the unredacted original and redact from there.

Testing the draft, then sending the export. Re-saving, merging or printing to a new PDF can carry the hidden text along with the box. Test the final file after every one of those steps.

Flattening and assuming that fixed it. Flattening merges a markup box into the page, but the words below it are not deleted by that alone. Check again afterwards.

Trusting the file name. A name ending in "redacted" says what someone intended, not what the file contains.

When the answer is yes

Stop sharing that copy. Find the original, unredacted document and make a new version with Redact PDF, which rebuilds each marked page and verifies the output before offering the download. The redaction walkthrough covers the marking choices and the order of steps, so this page will not repeat them. Then run the checker on the new file.

If a leaking version has already gone out, replacing it does not recall the copies people downloaded; treat that information as disclosed and tell whoever needs to know. Text is not the only thing that travels, either. Clear the properties and attachments with Privacy scan or follow the metadata guide.

Cases where a browser check is the wrong tool

The checker refuses password-protected PDFs. Ask the sender for an unlocked copy, or, if the file is yours and you know the password, remove it first with Unlock PDF.

If the leaked file is already part of a legal dispute or a data breach, a browser test is the start, not the answer: talk to your lawyer or data protection officer before doing anything else with it. If your employer requires approved redaction software or a signed redaction log, use that route. And for a purely scanned document, a careful human review at high zoom will tell you more than any text-layer scan.