You redact a social security number from a PDF using your PDF editor's redaction tool. You see the black box appear, save the file, and send it. The recipient converts the PDF to Word for editing and finds the social security number fully visible in the converted document, as if the redaction never happened. This is not a bug. It is the expected behavior of most redaction tools when the document undergoes a format conversion, and it has caused real data breaches.
In 2024, the UK Information Commissioner's Office reported that improper PDF redaction was the third most common cause of data breaches involving government documents (ICO, "Data Security Incident Trends", 2024). The most frequent root cause was not a failure to redact, but a failure to verify that the redaction survived the document's full lifecycle, including any format conversions it might go through downstream.
How Proper PDF Redaction Works at the Data Level
Proper PDF Redaction is fundamentally different from drawing a black box over text. When you use a real redaction tool, two things happen: the visible text gets covered with a black rectangle, and the underlying text content gets removed from the PDF's text layer. The characters themselves are deleted from the file's data stream. A reader application has nothing to display under the black box because there is nothing there.
When you draw a black rectangle over text using annotation tools and call it redacted, you have done what security professionals call cosmetic redaction. The text is still there in the PDF's data layer, fully intact and extractable. Anyone can select the text, copy it, paste it elsewhere, and read every word under the black box. Convert the PDF to any other format, and the conversion tool reads the underlying text, not the visual overlay. The redaction vanishes because it was never real in the first place.
The distinction between real and cosmetic redaction is so critical that government agencies and law firms now include it in mandatory training for staff who handle sensitive documents. A single improperly redacted court filing, FOIA response, or regulatory submission can expose personal data on a massive scale, and the reputational and legal consequences far outweigh the few extra seconds it takes to use proper redaction tools.
A particularly dangerous scenario arises when a document passes through multiple hands. Person A applies proper redaction, Person B opens the file and sees black boxes, assumes the redaction is complete, and forwards it. But if Person A used a cosmetic redaction tool without realizing it, Person B's confidence in the black boxes is misplaced. This chain-of-trust problem is why organizations should standardize on a single, verified redaction tool and train all staff to use it correctly.
A particularly insidious variant of cosmetic redaction is the white-box redaction. Some users draw a white rectangle over text, assuming that white on white makes the text invisible. This fails because selecting text or converting the document reveals the text underneath, and screen reader software reads it aloud regardless of visual color. White-box redaction is no redaction at all.
What Happens to Redaction During Format Conversion
Format conversion creates a new document by reading the source PDF and writing its content into a different format. The conversion tool parses the PDF structure and extracts text, images, and layout information. For PDF Format conversion, the critical question is what text content the conversion tool finds in the redacted areas.
If the redaction was genuine and the text was removed from the PDF's content stream, the conversion tool finds nothing in those areas and writes nothing. The output document has no text where the redactions were. If the redaction was cosmetic, a black box overlay with the text still present underneath, the conversion tool finds the text and dutifully writes it into the output document. The black box is a visual element, not a data element, and most conversion tools ignore visual overlays when extracting text content.
WukongPDF provides a redaction tool that removes content at the data level, not just the visual level. When you apply redaction through a properly implemented PDF Security tool that operates on the document's text stream, the removed information cannot reappear through format conversion because the data simply no longer exists in the file.
Some PDF to Word converters specifically attempt to preserve annotations, including comment boxes, highlights, and drawn shapes. If a cosmetic redaction was applied as an annotation, the converter may faithfully reproduce the black rectangle as a Word shape. But because the underlying text was never removed, the Word document will show both the black rectangle and the text beneath it, which is selectable, copyable, and fully visible to anyone who moves or deletes the rectangle.
Format conversion is not the only path through which redacted content can leak. Simply selecting all text in a PDF with cosmetic redactions and pasting into a text editor reveals the redacted content. Searching the PDF for a redacted term using the Find function will locate it even if it is visually covered. Screen readers and accessibility tools read the underlying text layer. These alternative extraction paths all bypass the visual overlay that cosmetic redaction relies on.
OCR-Based Redaction and the Reappearing Text Problem
Scanned PDFs add another layer of complexity to redaction. A scanned document is essentially a photograph of a piece of paper. The text is not stored as characters but as pixels in an image. Standard redaction tools that operate on text layers cannot remove text from an image, so they draw black boxes over the image instead. This is cosmetic redaction by necessity, not by choice.
To properly redact a scanned PDF, you need a tool that modifies the actual image data, replacing the pixel values in the redacted area with solid black. After the image is modified, you then run OCR on the document to create a text layer for the non-redacted content only. If you OCR before redacting, the OCR text for the redacted content lives in the text layer and will be extracted by any format conversion tool.
A common mistake with scanned PDF redaction is to OCR first to make the document searchable, then apply redaction marks, then re-save. This sequence leaves the OCR-generated text layer intact under the redaction marks. Any subsequent conversion or text extraction will recover the redacted text from the OCR layer. The correct sequence is: redact the image pixels first, then OCR the cleaned image. This ordering ensures the text layer never contains the redacted content.
How to Verify Redaction Survives Conversion
The only way to be certain your redaction is permanent is to test it. After redacting a PDF, convert it to a plain text file and search for any of the redacted content. If the text file contains the redacted data, your redaction was not effective. A faster verification is to select all text in the PDF after redaction and paste it into a text editor. If the paste buffer contains redacted text, the redaction was cosmetic.
For scanned PDFs, convert a page to an image format like PNG and visually inspect the redacted areas at high zoom. If you can see any trace of the original content through the black overlay, particularly on screens with high brightness or when printed, the redaction is insufficient. A single pixel of visible content can sometimes be enough to reconstruct the original information.
Create a verification checklist that includes each of these steps and require it as part of your document release process. The few minutes it takes to verify redaction are negligible compared to the hours, days, or months of remediation that follow a data breach caused by failed redaction. This step is not optional for any organization that handles personal data or confidential information.
Metadata Redaction: The Often-Overlooked Layer
Even when visible text is properly redacted, a PDF can still leak sensitive information through its metadata. PDF metadata includes the document title, author name, creation date, modification history, and sometimes the names of people who have reviewed or signed the document. Format conversion tools typically preserve metadata when possible, so redacted metadata survives conversion just as surely as the intended document content does.
A 2025 study by the SANS Institute analyzed 500 publicly available redacted PDFs from government websites and found that 12% contained sensitive information in metadata fields that had not been cleaned (SANS Institute, "Hidden Data in Publicly Released Documents", 2025). In several cases, the redacted information in the document body could be cross-referenced and confirmed using unredacted metadata. Cleaning metadata before release is as important as redacting visible content.
The same verification process should be applied to any document that undergoes conversion, regardless of how the conversion is performed. If your workflow includes an automated conversion step, build a redaction verification check into that automation rather than relying on manual spot checks. A script that searches the converted output for known redacted terms can catch failures that manual review might miss.
Building redaction verification into your standard document review checklist ensures this critical security step is never skipped.