Redact a PDF

Redact a PDF.

Not a black rectangle over the words — the words themselves, gone from the file. PDFMod rebuilds every page you mark from an image that never contained them, then reads the finished file back and runs twelve checks on it, line by line, in front of you. If a check fails, there is no download. If a check cannot run, it says so in those words rather than showing you a tick.

$99 once and the whole toolkit is yours — Acrobat is about $155 a year and stops working the day you stop paying. And the document you are taking a name out of stays on your laptop: we never see it, because nothing you open here is stored on a server.

Runs on this device · we never see your file

What we will and won’t claim

• We will say, when your marks sat on text PDFMod could read — it takes the phrase from under the box itself, so you do not have to type anything — that it does not appear in any page’s text, nor anywhere in the bytes of the file we produce: not raw, not UTF-16, not hex-encoded inside a compressed stream, and not hiding behind the escape codes a PDF is allowed to spell its letters with. A file may write a surname as (Whitm\157re) and every reader on earth will show you Whitmore; a search that looks for the eight letters in a row walks straight past it, so every string in the file is decoded before the search rather than searched as it sits. We looked before we offered you the download.
• We will warn you that the black bars are wider than what you searched for, because they usually are. Search a name and each mark covers the whole line of text it sits in, not the name alone. It shrinks to the words themselves only when the page has been rendered and the ink itself proves — three separate ways — that the smaller rectangle covers every pixel of those letters and nothing else. Two earlier versions computed that tight box from the font’s own numbers instead; both were wrong on ordinary documents, one of them leaving ORE of a surname legible, and both reported success. A rectangle that is too big is ugly and obvious and you can delete it before anything is written. A rectangle that is too small leaks, and you never see it. So the ugly one is the default, the tool counts how many of your marks came out that way and says so, and every mark is yours to remove before you run anything.
• We will look in the places a name actually hides. The search reads the whole document as one piece rather than page by page, so a name broken across a page break — “…in the name of John” ending one page, “Whitmore of…” opening the next — is still found. Comments, stamps and filled-in form fields are searched too: their words are in the file and plainly in front of you, but they are not in any page’s text, so a tool that reads only the page will tell you the name is not there. Those get marked at the annotation’s own declared box, which is exact and is not grown. And if the phrase is provably in the file but PDFMod cannot work out where on the page it is, it marks nothing and tells you to drag a box yourself, rather than blacking out the possibilities.
• We will also say where each rectangle actually landed, which no text check can. The finished file is rendered again and every painted rectangle is read back pixel by pixel to confirm it is solid — a black box beside the word passes every text, byte and structural check, because rasterising takes the text away wherever the box happened to be. And if a rectangle could not be grown out to blank paper, because what surrounds it is an underline or a dark background, that line says not checked and names the page for you to look at.
• We won’t claim a clean search on a page with no text on it. A scan is a picture of words: there is nothing under your marks for us to read, so there is no phrase to hunt for in the output, and a search that never ran proves nothing. In that case the five structural checks still run and still pass — those pages came back as bitmaps, with no text layer, no text-drawing instructions, no annotations, nothing left in the catalog and no page object the document does not list — and the report says out loud, before the two text lines, that none of your marks held readable text, so you can see why they are silent. You get the file, headed Rebuilt — and only partly checked, with the untested lines listed out. Those lines read nothing to check and not checked, in words, because a grey dash beside a column of ticks gets skimmed as a pass. A check that fails is different: then there is no download at all.
• We won’t call a page clean when part of it was never text. A rebuilt page is an image, and every check above reads text — the output’s text layer, its bytes, its operators. Anything that got onto the paper without passing through a text layer was never in scope for any of them: a photograph, a stamp whose artwork is one, a scanned signature, a wordmark drawn as outlines. Where a page you marked carries something like that, the report adds a line naming what it found and which page, marks that line not checked, and heads itself Rebuilt — and only partly checked rather than Checked, and clean. Your rectangles were still painted and still read back from the finished pixels. What PDFMod cannot tell you is that the name is not somewhere else on that page as a picture — so it says that, instead of counting the words it could read as the whole page. Look at it before you send the file.
• We won’t say it is irreversible. That is a claim about the universe, not about a file.
• We won’t say the document is preserved exactly. Pages you mark become images: text selection, search, screen-reader structure, links, comments and form fields are lost on those pages. Pages you don’t mark are copied through untouched. Those images are drawn at 300 DPI, except on a page too large to hold at that size in a browser canvas — past roughly 27 inches on its longest side, so a poster or a plan — where the resolution steps down as far as it has to. The report names the figure it actually used rather than the one we would like to advertise.
• We won’t say it works on any PDF. Encrypted, XFA and digitally signed files are refused, because we cannot prove the result for them.
• And: your original file is untouched and still contains everything. That copy is yours to manage.