How to Redact a Document Before Sharing It Online

Before you send a PDF, screenshot, ID photo, contract, or form, pause for one minute and ask: "Does the recipient really need every detail in this file?"

Most leaks are not dramatic hacks. They are ordinary overshares: a bank statement with the full account number visible, a screenshot that includes a home address, a contract with another client's name in the footer, or a PDF where the "black box" can be selected and removed.

Redaction is the habit of removing sensitive information before sharing. It is not just for lawyers. It is useful for freelancers, accountants, HR teams, landlords, students, families, and anyone sending personal documents online.

This guide gives you a practical redaction checklist and a safer way to share the finished file.

Detailed Redaction Guides

Use this page as the general checklist. If you are working with a specific file type, use the more focused guide:

What you are sharing	Use this guide
PDF contract, report, statement, or form	How to redact a PDF before sending
Bank statement for rent, loan, tax, or support	How to redact a bank statement before sharing
Passport, driver's license, national ID, or residence card	How to redact an ID card or passport copy
Screenshot for support, AI, bug reports, or work chat	How to redact screenshots before sharing

What Should You Redact?

Start with the purpose of the share. If the recipient only needs to verify your name and payment amount, they probably do not need your full account number, full address history, other transactions, or unrelated notes.

Common fields to remove or hide:

Document type	Usually redact
ID card or passport scan	ID number, document number, date of birth if not required, machine-readable zone, signature, address
Bank statement	Account number, routing number, unrelated transactions, balances if not required
Tax form	Social Security number or tax ID, dependent details, employer IDs not needed by the recipient
Contract	Other client names, pricing not relevant to this share, signatures, internal notes, revision comments
Screenshot	Browser tabs, bookmarks, profile photos, email addresses, notifications, exact timestamps, file paths
Medical document	Patient ID, diagnosis details not required, insurance number, unrelated visits
Shipping or utility bill	Full address, customer number, barcode, QR code, account number

The best rule is data minimization: share the least information that still solves the task. The FTC's business guidance makes the same point in security terms: keep only what you need, protect what remains, and dispose of what you no longer need.

Redaction Is Not the Same as Decoration

Bad redaction looks hidden but still leaks. These methods are risky:

• Drawing a black rectangle over text in a PDF editor without flattening or exporting correctly
• Using a translucent highlighter instead of an opaque block
• Cropping a screenshot but leaving the original image embedded in a document
• Blurring text lightly enough that it can be reconstructed
• Sharing a Word or Google Docs file with comments, revision history, or hidden metadata still attached
• Redacting only the visible page while leaving the same detail in headers, footers, QR codes, barcodes, or file names

Good redaction removes the information from the final shared copy. The recipient should not be able to select, copy, search for, enhance, or recover the hidden text.

A Safe Redaction Workflow

Use this workflow when the document contains personal, financial, legal, medical, or business-sensitive information.

1. Make a separate copy

Never redact the original. Create a duplicate named something like:

client-intake-redacted-copy.pdf

Keep the untouched original in a private folder. Work only on the copy.

2. Decide what the recipient actually needs

Write one sentence:

The recipient needs to confirm my name, payment date, and last four digits only.

That sentence becomes your filter. Anything outside that purpose should be removed or hidden.

3. Redact visible sensitive fields

Use a real redaction tool when possible. In a PDF editor, look for a feature named "Redact", not just "Draw", "Highlight", or "Shape".

For screenshots or images, use solid opaque blocks. Do not rely on weak blur for text, numbers, QR codes, or barcodes. If you must blur, use strong pixelation and verify that the result cannot be read at high zoom.

4. Check hidden places

Sensitive data often appears outside the obvious body text. Review:

• Headers and footers
• File names
• Page thumbnails
• Comments and annotations
• Revision history
• QR codes and barcodes
• Embedded images
• Document properties and author metadata
• Clipboard leftovers in pasted screenshots

For photo and file metadata, also read our metadata removal guide.

5. Export or flatten the redacted copy

After applying redactions, export a new file. For PDFs, use the editor's "Apply redactions" or "Sanitize document" action if available. For screenshots, save a new PNG or JPG after the blocks are applied.

Do not share the editable working file unless you are certain the redaction is irreversible.

6. Test the final file like an attacker

Open the redacted copy in a different app, then test:

• Can you select the blacked-out text?
• Can you search the PDF for the hidden name, account number, or address?
• Can you copy and paste the hidden area into a text editor?
• Does zooming in reveal blurred numbers?
• Do thumbnails, comments, or document properties still reveal details?
• Does the file name itself leak information?

If any answer is yes, redo the redaction.

Redacting PDFs Before Sending

For PDFs, the safest approach is:

1. Duplicate the original PDF.
2. Use a real PDF redaction feature.
3. Apply the redactions permanently.
4. Remove comments, metadata, hidden layers, and attachments.
5. Save as a new PDF.
6. Reopen the new PDF and search for the removed values.

If you do not have a reliable PDF redaction tool, consider converting the specific page to an image, applying opaque blocks, and exporting that image as the shareable copy. This can reduce hidden text risk, but it also removes selectable text and may not be appropriate for formal records.

For the detailed PDF workflow, read how to redact a PDF before sending. For broader PDF protection, see how to password-protect a PDF.

Redacting Screenshots Before Sharing

Screenshots are dangerous because they capture more than the thing you meant to show.

Before sharing a screenshot, check:

• Browser tabs and window titles
• Email addresses and account names
• Slack, Discord, or messenger sidebars
• Desktop file names
• Notifications
• Location, date, or calendar details
• API keys, tokens, invite links, and QR codes
• Other people's names or messages

Crop first, then redact. Cropping reduces the surface area. Redaction handles what remains. For a more detailed workflow, use how to redact screenshots before sharing.

If the screenshot is proof for support, leave enough context to solve the problem but remove anything unrelated. For example, keep the error message and order ID, but hide your address, payment method, and unrelated browser tabs.

Redacting Documents for AI Tools

If you are uploading a document to an AI tool, redaction matters even more. AI systems may process pasted text, screenshots, PDFs, file names, and metadata. OWASP lists sensitive information disclosure and prompt injection among the major risks for LLM applications, which is a useful reminder that AI inputs should be treated as a security boundary.

Before using AI with a document:

• Replace real names with roles: "Client A", "Vendor B", "Employee 1"
• Replace account numbers with placeholders: ACCOUNT_LAST4_1234
• Remove addresses, phone numbers, email addresses, and IDs unless they are essential
• Remove signatures, barcodes, QR codes, and scanned IDs
• Avoid uploading contracts, medical files, tax records, or customer lists to consumer AI tools unless your policy explicitly allows it

For a broader AI privacy workflow, read how to use AI tools safely with sensitive data.

How to Share the Redacted File Safely

Redaction reduces what is inside the file. You still need to control how the file travels.

Email attachments and chat uploads can stay in inboxes and message history for years. A safer workflow is:

1. Redact the document.
2. Export and verify the final copy.
3. Upload it through a password-protected, expiring share.
4. Send the link and password through separate channels.
5. Expire the link after the recipient has downloaded it.

With LOCK.PUB file sharing, you can send a protected file link without leaving the document directly in a chat thread. If you need someone else to send documents to you, use a secure request link instead.

A Quick Redaction Checklist

Before sending any sensitive file, confirm:

• I made a copy and kept the original private
• I know exactly what the recipient needs
• I removed or hid unrelated personal data
• I checked headers, footers, comments, metadata, QR codes, and file names
• I exported or flattened the final file
• I searched the final file for hidden values
• I used a protected sharing method instead of a raw email attachment
• I set an expiration if the document is time-sensitive

Frequently Asked Questions

Is blurring enough for redaction?

Usually not for text, numbers, QR codes, or barcodes. Blur can sometimes be reversed or guessed, especially when the hidden value has a known format. Use solid opaque blocks or a real redaction tool whenever possible.

Can someone recover text under a black box in a PDF?

Yes, if the black box is only an overlay. In bad PDF redaction, the original text remains underneath and can be selected, searched, copied, or exposed by removing the overlay. Always apply redactions permanently and test the final PDF.

Should I redact before password-protecting a file?

Yes. Password protection controls access, but it does not reduce what the recipient can see after unlocking. Redact first, then password-protect or share through an expiring secure link.

What if the recipient needs the full document?

If the recipient truly needs the full document, do not redact the required fields. Instead, focus on secure delivery: password-protected sharing, short expiration, separate password channel, and confirming that the recipient is the right person.

Final Thought

Redaction is a small habit that prevents large mistakes. Before sending a document, remove what the recipient does not need, verify that it is really gone, and share the final copy through a protected link.

Start with a redacted file, then share it securely with LOCK.PUB.

Further Reading

• How to redact a PDF before sending
• How to redact a bank statement before sharing
• How to redact an ID card or passport copy
• How to redact screenshots before sharing
• FTC: Protecting Personal Information: A Guide for Business
• FTC: Start with Security: A Guide for Business
• NIST Privacy Framework
• OWASP Top 10 for Large Language Model Applications