How to Redact and Sanitize a PDF: Limits to Know

PolyPDF redaction and Sanitize Document address different structures, and neither is a universal scrubber. Redaction can rewrite supported searchable text operators that intersect a marked region. When no supported text is removed, the engine can still place a black fill over the region and complete the operation. Vector outlines, text converted to paths, and other graphics may therefore remain in the file beneath the appearance.

A result that reports no text removed does not establish redaction, even when the page looks black. Stop and use an approved content-removing workflow for that material.

1. Duplicate the source PDF and keep the original where the working process cannot overwrite it.
2. Confirm the target is ordinary searchable text by finding and selecting it. If it is a scan, image, outline, or vector path, do not use this workflow as proof of removal.
3. Choose the Redact tool and draw a tight region around each supported text item. Review repeated names, headers, footers, and similar pages before applying anything.
4. Apply the redactions and read the result. A refusal, error, or “no text removed” outcome means removal was not established; do not rely on the black appearance.
5. Save under a new candidate filename, close it, and reopen that exact saved file.
6. Search and extract text from the whole saved file. Try selecting and copying across the former region and inspect it in a second recipient-style viewer.
7. For confidential, regulated, privileged, or legally sensitive content, follow the organization’s approved redaction and inspection process even when these checks pass.

Search failure alone is not proof that visible content was removed. A page can mix normal text operators, raster pixels, vector lettering, clipping paths, and reusable Form XObjects. The searchable layer might disappear while an image or outline remains, or the page may look covered while recoverable vector commands remain in the file.

PolyPDF checks detected top-level image placements before applying a redaction, but that detection does not recurse through every nested Form XObject. An image embedded inside reusable form content can therefore evade the overlap check. Text converted to outlines is vector artwork, not a supported text-show operation, and may also remain beneath the fill.

• Do not infer content type from appearance. Searchability is useful evidence, but it does not reveal every nested object.
• Do not flatten, rasterize, print, or cover a page and assume that step alone meets a security or records requirement.
• For a scanned page or image-based identifier, use an approved image-aware redaction tool and verify the resulting pixels and PDF structure.
• For outlined or vector lettering, require a process that removes or replaces the underlying drawing commands rather than adding an opaque shape.
• If you cannot independently inspect the final file, do not release sensitive material based on the PolyPDF result alone.

A second viewer is useful for visual interoperability, but it is not a forensic inspection tool. Confidential release may require text extraction, object inspection, and an approved review record.

The build 16 dialog offers separate choices for document metadata and XMP packets, page thumbnails, attachments, JavaScript/actions, and optional form or signature-field removal. Those labels describe the requested categories, not a guarantee that every possible location in the PDF object graph is traversed.

• Metadata cleanup targets the document information dictionary and XMP structures handled by the command. Reopen the output and inspect properties again.
• Attachment cleanup can remove name-tree and selected associated-file references, but a direct FileAttachment annotation with its own embedded-file reference can survive.
• JavaScript cleanup targets known name-tree, catalog, and page locations, but arbitrary annotation, form, outline, or nested additional-action entries can survive.
• Form and signature-field removal is destructive and optional. Use it only when interactivity and those fields are intentionally being discarded.
• Keep the untouched source and save each candidate output under a distinct name so a partial cleanup does not replace the record copy.

The screenshot above proves which choices the dialog presents. It does not prove what any particular saved file contains after processing.

Close and reopen the exact candidate file so every check is based on saved bytes rather than the in-memory view. A complete review follows the information through more than one surface: rendered pages, searchable text, document properties, embedded-file structures, annotations, form fields, bookmarks, links, and actions.

• Search for the full sensitive values and useful fragments, then run independent text extraction against every page.
• Inspect at high zoom and in a second PDF viewer, including print or export output when recipients use those paths.
• Use an approved structural inspection tool to inventory embedded files and inspect annotation, form, outline, and additional-action entries.
• Confirm page count, bookmarks, links, forms, signatures, layers, and print appearance still match the release requirements.
• Record the input filename or hash, output filename, reviewer, date, tool versions, and checks performed when the process requires an audit trail.

Create or use an owned disposable PDF containing a fake name and phone number as ordinary searchable text, a second copy of the same words converted to vector outlines, a small image containing the number, normal author metadata, a name-tree attachment, and a direct FileAttachment annotation. Keep a written inventory of every test object.

Mark the searchable instance, apply redaction, and confirm the result reports actual text removal. Save, reopen, search, extract, and inspect. Treat the outlined and image instances as failures for this workflow even if they look covered. Then run Sanitize Document with the relevant choices, save again, and inspect both attachment forms plus the action inventory. This controlled test makes the limits visible without putting real confidential material at risk.

This exercise is a product-capability test, not authorization to use PolyPDF as the sole redaction or sanitation control for sensitive documents.