Hidden Text in a PDF: What Sits Under a Redaction Box

Hidden text in a PDF is any text the file stores but the page does not show: an invisible OCR layer, words covered by a shape, white letters on a white background. A black box drawn over a sentence covers it on screen and leaves it in the file, where copy, search and text extraction still reach it.

What is hidden text in a PDF?

Hidden text is a run of real characters inside a PDF that a person looking at the page cannot see. The characters are stored like any other text in the file. Only their display differs: they are invisible, covered, colored to match the background, or placed outside the area the reader shows.

A PDF page is not a flat sheet. It is a list of separate objects, each drawn in turn: a picture here, a line of text there, a rectangle on top. What you see is the result of stacking them. What the file holds is the whole list. Software that searches or copies works from the list and ignores the stacking.

Most hidden text is harmless, and the OCR layer is the reason a scanned exhibit can be searched at all. It becomes a problem at one moment: when you believe a file shows everything it contains, and you send it to someone outside the firm.

Why does a black box drawn over words leave the words in the file?

A drawn black box is a new object placed on top of the text. It adds something to the page and removes nothing. The words stay in the file as text, in the same place, and any program that reads text from a PDF reads them as if the box were not there.

Drawing tools, highlighters set to black and comment rectangles all work this way. They were made for marking up a page, and markup is designed to sit above the content and to be removable. A redaction needs the opposite: the content itself gone.

Federal courts have warned filers about this in plain terms. The District of New Jersey's notice on effective redaction techniques for e-filing says:

Highlighting text in black or using a black box over the data in MS Word or Adobe Acrobat will not protect the data from being able to be seen. Changing the text color to white so it disappears against the white screen/paper is similarly ineffective.

The Court of Federal Claims makes the same point. Its PDF file redaction best practices say that the highlighter function "creates a black box over the data, but it merely hides the data."

A worked example

Suppose a paralegal at the fictional firm Brandt Ellery prepares Exhibit C in Kessler v. Northgate Supply. One paragraph of a letter states a settlement figure from an unrelated matter. She opens the PDF, draws a filled black rectangle over the figure, saves, and sends the exhibit to opposing counsel. On screen and on paper, the figure is gone.

Opposing counsel's office then loads the exhibit into its review platform, as it does with every document it receives. The platform indexes the text of each file, and the figure is part of that text. Weeks later a routine search across the production returns the paragraph, figure included.

Search a redacted exhibit for the party name, the claim number, and any citation you covered with a box before the file leaves. The damages figure can remain in hidden characters under a rectangle that looks solid. Run the search on the copy you will send, with the picture beside you.

Nobody set out to defeat the box. The file handed the figure over because it was still text in the file, and ordinary software reads text. The lesson is for the sender: the exhibit should have been tested before it left.

The same failure happens upstream of the PDF. Text shaded black in a word processor and then saved as PDF arrives as ordinary text with a dark background behind it.

The OCR text layer as hidden text nobody remembers adding

An OCR text layer is hidden text by design: recognized words stored invisibly behind the picture of a scanned page. It causes trouble when someone treats the scan as only a picture, covers part of the picture, and forgets that a second copy of the words sits underneath.

This is an easy way for a careful person to get caught. A scan looks like a photograph of paper. Blacking out part of a photograph feels final. But the scan may have been through OCR three steps earlier, at a point nobody recorded:

• The office copier was set to produce searchable PDFs, so the layer was there from the first second. The post on whether the scanner or the software reads the page explains where that setting hides.
• A document management system ran recognition when the file was saved into it.
• A colleague ran OCR so they could search the file, then passed it on under the same name.

In each case the page looks identical before and after. A box drawn on the image hides the pixels. The layer still holds the name, the account number or the diagnosis in plain characters.

Converters can carry old layers forward too. Schema Law's searchable PDF export is your original file with a hidden text layer added, so it is built on whatever you uploaded. If the upload already held a text layer or covered words, do not assume the export is free of them. Redaction is not among the things Schema Law does, and it is not a way to clean a file.

The order of the two steps decides whether this happens. If the words are removed from the image first and OCR runs afterwards, the software can only recognize what is still visible. Which order to use in a production, and how to handle copies already exported to other formats, is the subject of the post on whether to OCR before or after redaction.

Other hidden content: metadata, comments, layers and cropped areas

Text under a box is one kind of hidden content. A PDF can also carry document properties, comments, switched-off layers, the parts of a page that were cropped away, attachments and earlier versions. None of it shows on the printed page, and all of it travels with the file.

The District of New Jersey notice gives its own list of examples: "the name and type of file, the name of the author, the location of the file on your file server, the full-sized version of a cropped picture, and prior revisions of the text."

Cropping deserves a second look because it feels like cutting. In a PDF, cropping usually changes the window through which the page is shown. The whole page remains behind the window. An exhibit cropped to show one paragraph of a letter can still contain the full letter.

Comments carry a quieter risk. A note that says "ask client whether this date is right" is work product sitting in a file that is about to be served.

How do you find hidden text before a PDF leaves the firm?

Test the outgoing file the way a recipient's software would read it: select everything, copy it out, search it, and compare what comes back with what the page shows. If any text appears that you cannot see on the page, the file holds hidden text.

Run these checks on the final file, after the last edit, under the name it will be sent with.

1. Compare the file's text with the page. On each page you covered, cropped or marked up, select all, copy, and paste into a plain text editor. Read the pasted text against the page. Words that appear in the paste and not on the page are hidden.
2. Export the whole file to text. Use Save As Text or an equivalent, and skim the text file. This catches pages you did not think to check, and white or off-page text that no one remembers.
3. Click each black box in your own file. If it selects, moves or shows handles, it is an object lying on top of the page, and the words under it are still there.
4. Open the panels. Comments, layers, attachments and bookmarks should be empty or contain only what you intend to send.
5. Read the document properties. Check author, title and any custom fields.
6. Look at the full page box. If a page was cropped, check what lies outside the crop.
7. Write down what you tested. A line in the file such as "Ex. C final: text export read against pages 4 and 9, panels empty, properties cleared" shows the check was done.

A redacted production needs one more test: a search of the outgoing copy, and of every text file that travels with it, for each term you removed. The post on redaction order sets out how to test a redacted production for leftover text, including fragments and companion files.

These checks are for files your own office is sending. If a file you receive shows text inside another party's redaction, that text is not yours to use because software displayed it. Stop, do not look for more, and take it to the supervising lawyer. What must happen next is a professional-responsibility question that varies by jurisdiction.

Removing hidden text: true redaction, sanitizing and flattening

Three remedies exist, and they remove different things. True redaction deletes chosen content from the file. Sanitizing strips metadata and other hidden items across the whole document. Flattening to images replaces every page with a picture, so no text of any kind is left.

True redaction is a specific feature of PDF editors, separate from the drawing tools. It normally works in two steps: you mark areas, then you apply the redactions, and only the second step deletes anything. Save the result under a new name. A file with redactions marked but not applied is no safer than one with drawn boxes.

Sanitizing, sometimes labeled "remove hidden information" or "inspect document", is a sweep of the whole file. It does not know which words are sensitive. It complements redaction and does not replace it.

Flattening needs care with the word itself. Some guidance uses "flatten" to mean printing the file to a PDF printer. The District of New Jersey notice describes that as a way to remove "most meta-data and the interactive features". Printing to PDF often carries the text across as text, so it is no cure for words under a box. Flattening in the sense that removes hidden text means turning each page into an image. The steps, and the price the recipient pays in lost search, are in the post on converting a PDF to a non-searchable PDF.

Whichever remedy you use, run the checks for hidden text again on the result. Tools differ, and settings get missed.

Rules on what must be redacted from a filing, and who is responsible, come from your court's rules and orders. The District of New Jersey notice says the responsibility for redacting personal identifiers "rests solely with the parties". Read your own court's version.

When redacted pages come to you from someone else, the working problem is different: recognition returns nothing for the covered area, and the text may read as if nothing were missing. The posts on redactions and blacked-out passages in police reports and redaction boxes and exemption codes in agency releases cover those files.