Manually searching a 200-page PDF for every credit card number and redacting each one individually is tedious, slow, and dangerously error-prone. A single missed number constitutes a preventable data breach. PDF Redaction using pattern matching automates this process by finding every text string that matches a specified format, such as a 16-digit credit card number, and applying redaction marks to all instances across the entire document in a single operation.
Pattern matching, also called regular expression or regex matching, defines a text pattern rather than a specific string. The pattern captures the format of sensitive data without needing to know the exact values beforehand. When the redaction tool runs, it searches all text in the document for matches against the pattern, records the position of each match on its page, and draws opaque black rectangles over those positions. The underlying text is then permanently removed.
WukongPDF's PDF Security tools include pattern-based redaction capabilities for automated sensitive data removal before document sharing or publication.
How Pattern-Based Redaction Works on PDF Text Layers
Pattern-based redaction operates on the text layer of the PDF rather than on its visual appearance. The tool extracts all text content from every page, searches for matches against the specified regex patterns, and records the exact position of each match. It then draws opaque black rectangles over those positions and permanently removes the underlying text characters, replacing them with blank space that cannot be recovered.
A critical limitation of pattern-based redaction is that it only finds text stored as actual characters. Credit card numbers that exist only as part of a scanned image rather than as selectable text will not be found. For scanned documents, you must first run OCR to create a text layer, then run pattern-based redaction on the OCR output. Even then, OCR errors may cause some numbers to be missed by the pattern match.
The regex pattern must also account for how the PDF internally stores the text. A credit card number displayed as 1234 5678 9012 3456 to the reader may be stored internally as four separate text blocks with spaces between them. The pattern needs to be flexible enough to match across these internal boundaries, which means allowing for optional spaces, hyphens, or other separators between digit groups.
Creating Precise Regex Patterns for Credit Card Numbers
A credit card number pattern must balance precision against completeness. A pattern that exactly matches the format 1234-5678-9012-3456 catches numbers written with hyphens but misses the same numbers written as 1234567890123456 or 1234 5678 9012 3456. A pattern that is too broad, such as any sequence of exactly 16 digits, catches account numbers, phone numbers, and other numeric identifiers that should not be redacted.
Build patterns with optional separators between digit groups. The expression that allows for hyphens, spaces, or no separator between each group of four digits covers the three most common credit card number formats. Test the pattern on a copy of the document before committing to the full redaction. Review every match to confirm the pattern found all the intended sensitive data and did not match anything that should remain visible.
For documents containing multiple types of sensitive data, create a separate pattern for each type and run them as individual redaction passes. Credit card numbers get one pattern and one pass. Social Security numbers get another. Email addresses get a third. Separate passes with individual review between them prevent false positives from one pattern from interfering with the correct matches of another.
Step-by-Step: Running Pattern Redaction in Acrobat Pro
Open the PDF in Adobe Acrobat Pro and go to Tools, then Redact. In the Redact toolbar, click the dropdown next to Mark for Redaction and select Find Text. Enter the regex pattern in the search field and check the Use Regular Expressions box. Acrobat searches the entire document and displays a list of every match in the search results panel, organized by page number.
Review every match before applying redaction. Click each match in the panel to jump to its location on the page. Verify that the matched text genuinely contains sensitive data that should be redacted. If any match is a false positive, uncheck it in the match list. After reviewing all matches, click Mark Checked Results for Redaction. Acrobat places redaction marks over all checked items. Finally, click Apply Redactions in the toolbar to permanently remove the marked text.
After applying redactions, save the file under a new name that clearly distinguishes it from the original. The original unredacted file should be stored securely or destroyed. The redacted file is now safe to distribute because the sensitive text has been permanently removed from the document data, not merely covered by a visual overlay.
Verifying That Redaction Is Complete
Once complete, after applying pattern-based redaction, verify your work before sharing the document. Open the redacted PDF and search for a known credit card number that was present in the original. The search should return zero results. Select all text on every page and copy it to a plain text editor. The copied text should contain no credit card numbers or partial numbers.
In document workflows, for documents with legal or regulatory consequences if redaction fails, have a second reviewer independently verify the output. The second reviewer searches for known sensitive patterns and visually scans every page. An independent reviewer catches errors that the original reviewer may miss due to familiarity with the document content.
Visual inspection remains necessary even after automated verification. Pattern matching works on selectable text. It cannot detect credit card numbers that appear only in images, such as a photograph of a credit card embedded in the PDF or a handwritten number on a scanned form. For these cases, manual redaction using the Redact tool's drawing mode is required.
Handling Edge Cases and Non-Standard Formats
Credit card numbers occasionally appear in non-standard formats that defeat simple regex patterns. A number split across two lines of text, a number written with spaces between every digit, or a number embedded in a longer numeric string like an account reference all require pattern refinements or manual review.
In document workflows, for numbers that wrap across lines, extend the pattern to allow newline characters as optional separators between digit groups. For numbers embedded in longer strings, use word boundary assertions in the regex to ensure the matched digits are a standalone number rather than part of a larger identifier. Despite these refinements, a small percentage of sensitive data will always evade automated detection and require manual identification.
Document your findings during manual review to improve future pattern accuracy. If a particular non-standard format appears across multiple documents from the same source, develop a pattern that targets it specifically. Over successive redaction projects, the pattern library grows more comprehensive and the manual review burden decreases.
| Pattern | Matches | Best For |
|---|---|---|
| \d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4} | 16-digit card with optional separators | Visa, Mastercard, Discover |
| \d{3}-\d{2}-\d{4} | US Social Security Number format | SSN redaction in tax documents |
| [A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,} | Email addresses | Contact information removal |
Building a Reusable Redaction Pattern Library
Organizations that regularly redact documents for FOIA responses, court filings, or public records release should invest in building a reusable pattern library. Test each pattern on representative document samples before adding it to the library. Document which patterns work for which document types. Share the library across the team so that every member applies consistent redaction standards.
From a practical perspective, in practice, the pattern library should include not only the regex expressions but also notes on when each pattern should and should not be applied. A pattern for US Social Security numbers should not be applied to documents from non-US sources. A pattern for 16-digit credit card numbers should note the risk of false positives on account numbers. Clear application guidance prevents misuse of patterns in contexts where they were not designed to be used.
Review and update the pattern library at least annually. Payment card formats evolve. New types of sensitive data emerge through regulation. Old patterns may develop false positive issues as document formats change. A maintained pattern library is a living organizational asset that improves with each use.
Pattern-based redaction transforms the tedious and risky task of manually finding and redacting every instance of sensitive data into an automated process with human verification. The pattern finds the matches. The human confirms them. Together they produce redaction quality that neither could achieve alone.
Archiving Redaction Records for Compliance Audits
Once complete, after completing a sensitive redaction project, archive the patterns used, the number of matches found and redacted, and the identity of the reviewer who verified the output. This documentation serves as an audit record demonstrating that a systematic redaction process was followed. In the event of a data breach investigation or compliance audit, the redaction records provide evidence of due diligence.
Looking at this broadly, in practice, the audit record should include the original filename, the date of redaction, the specific patterns applied, the total number of matches found per pattern, and the name of the person who reviewed and approved the redacted output. A simple text file or spreadsheet template completed at the end of each redaction project takes minutes to fill out and provides lasting compliance value.
For organizations subject to regulations like PCI-DSS, HIPAA, or GDPR that mandate specific data protection measures, documented redaction procedures support compliance demonstrations. The procedures show that the organization has a defined, repeatable process for removing sensitive data from documents before they leave the controlled environment.