How to anonymize a document before sharing it

Why doesn't a black box actually redact the text?

Because the box is a shape placed on top of the text, not a change to the text. In a PDF or a word-processor file, the words are still there underneath. Drag the cursor over the area, copy, paste somewhere else, and they are readable again.

The same goes for black highlighting, or for changing the font color to match the background. The data stops being visible, but the file keeps it, and it also turns up when someone uses the search box in a PDF reader.

The test is simple: open the file, select all, copy, and paste into a plain text editor. If the data shows up, it has not been removed.

Where else can a document leak personal data?

The visible text is only part of the file. These are the usual leaks:

• Document metadata: author, organization, software used, creation and modification dates.
• Comments and tracked changes: deleted text can survive in the revision history, along with the name of whoever edited it.
• Hidden layers and objects: text outside the visible margin, switched-off layers, hidden sheets, data embedded in a chart.
• The file name: a file named after the person undoes all the work.
• Low-quality blur or pixelation: lightly blurred text can remain legible or be reconstructed. Only a solid block on a flattened image removes the information.
• Headers, footers and stamps: they often repeat case numbers, names or signatures on every page.

Photos placed in a document carry their own metadata as well. If that applies to you, see how to remove metadata from photos.

What personal data should you remove from a document?

Everything that could identify a person, directly or in combination with something else. It helps to sort it into groups.

The last group is the one people forget. "The principal of the only school in town" contains no name, yet it points to a specific individual. Ask yourself whether someone who knows the context could recognize the person from what you left in.

What is the difference between anonymization and pseudonymization?

Anonymizing means leaving the document in a state where it can no longer be linked to a person, not even by whoever prepared it. Pseudonymizing means replacing the data with codes or labels, such as "Person A", while keeping somewhere else the key that maps back to the real data.

The distinction has consequences. A pseudonymized document remains sensitive for as long as that key exists, or as long as indirect details let a reader work out who is who. If you have to comply with a data protection rule, what it requires is set by the law where you are, not by what you call the file.

How do you redact a document or PDF by hand, step by step?

One principle covers it: replace the text, do not cover it. This method works in any word processor.

1. Work on a copy. Store the original separately and leave it alone.
2. List what you will remove. Read the whole document and note names, numbers and indirect details.
3. Replace, do not cover. Use find and replace to swap each item for a generic placeholder, such as [NAME 1] or [ADDRESS]. Use the same placeholder for the same person so the text still makes sense.
4. Search for variants. Surname only, initials, nicknames, the name in capitals, a number with and without separators.
5. Accept all changes and delete comments. Go through headers, footers, footnotes and tables.
6. Export to a new file. Paste the clean text into a blank document or export a fresh PDF rather than saving over the old one.
7. Clear the metadata and rename the file.
8. Verify. Select all, copy, paste into a text editor, and search for every item on your list.

If all you have is a PDF and not the editable source, use your PDF editor's true redaction feature, the one that deletes content, not the drawing tool. If you do not have one, cover the data with solid blocks, convert the pages to images, and confirm the text can no longer be selected.

Can you trust automatic detection of personal data?

As a first pass, yes; as the final review, no. Software is good at finding things with a recognizable shape, such as email addresses, phone numbers or ID numbers. It struggles with anything that depends on context: a surname that is also an ordinary word, a nickname, a misspelled name, or an indirect identifier.

It errs in both directions. It can miss a real item, and it can flag something that is not personal, such as a street or institution name you need to keep. That is why the output always needs a human read before it is shared.

What our tool does

The anonymize document tool combines rules and AI to find names, ID numbers and other personal data. Before it hands anything back, it shows a review screen listing every finding, where you can untick the ones you want to keep and add any that were missed.

The result is a plain-text version with placeholders such as [NAME 1] in place of each item. It does not keep the original layout: if you need the same formatting, you will have to paste the text into your own template. It also reads scanned PDFs and photos of documents using text recognition, and the uploaded file is deleted when processing ends.

To confirm afterward what changed between the original and the clean version, you can compare the two documents.

What should you check before sending a redacted document?

1. Select all and paste into a text editor: nothing from your list appears.
2. Searching for each name, surname and number returns no results.
3. No comments, pending changes or hidden text remain.
4. The metadata shows no author or organization.
5. The file name identifies no one.
6. The indirect details left in do not let a reader work out who it is.
7. Headers, footers, signatures, stamps and images have been reviewed.
8. Someone unfamiliar with the matter read the result and recognized no one.

What mistakes do people make when redacting a document?

• Covering instead of deleting. The most common mistake, and the easiest to test for.
• Working on the original. Without a backup you cannot go back or compare.
• Removing only the full name. Initials, stray surnames and indirect details stay behind.
• Forgetting the metadata and the file name.
• Pixelating or blurring text. It is not a safe way to remove information.
• Trusting automatic detection without reviewing it.
• Sending the wrong file. Name the clean version clearly and keep it apart from the original.