Text Redaction Tool

Visual redaction is not redaction

The recurring failure is covering text rather than removing it. A black rectangle over a PDF is a drawn object with the text still underneath, recoverable by selecting and copying. Highlighting in a word processor changes appearance only. Setting text colour to match the background hides nothing from a search or a screen reader. Every one of these has produced a real disclosure of names, addresses and case details in published documents. Redaction means the characters are gone from the file, not obscured in the rendering.

Metadata carries what the body no longer does

Documents carry author names, organisation, edit history, tracked changes, comments and previous revisions. Images carry EXIF including GPS coordinates and device identifiers. A carefully redacted document with intact metadata discloses through a channel nobody looked at. Stripping metadata is a separate step from redacting content and is skipped far more often.

What actually needs removing

Direct identifiers are the obvious ones: names, emails, phone numbers, addresses, government identifiers, payment details. Technical data is easy to overlook — IP addresses, API keys, tokens, internal hostnames, database connection strings and stack traces containing file paths and usernames. Logs and error reports pasted into a support ticket or a public issue are a persistent source of credential leaks.

Removing names is not anonymisation

Quasi-identifiers re-identify people in combination. Postcode, date of birth and sex identify most individuals in a population uniquely, which is the finding that reshaped data protection practice. A dataset with names removed and those three fields intact is pseudonymised, not anonymised, and remains personal data under GDPR with all the obligations attached.

Consistent replacement preserves meaning

Replacing every name with [REDACTED] destroys the ability to follow who did what. Replacing consistently — the same person becoming [PERSON_A] throughout — keeps the document readable while removing identity. That consistency is itself a disclosure risk in a small population, since the pattern of interactions can identify someone, but for most purposes it is the right trade.

Verify by searching the output

After redacting, search the file for the removed values, extract its text with a tool rather than viewing it, and check the metadata separately. Automated detection catches structured formats such as card numbers and emails reliably and free-form identifiers poorly, so a human pass over the result remains necessary.