How Redact works

Your document is never uploaded

There is no server and no backend. When you open a PDF, Redactreads it in memory, renders each page with pdf.js (Mozilla's open-source PDF renderer, running as WebAssembly), and edits it with pdf-lib. The file and its extracted text never leave your browser. The site's Content-Security-Policy (connect-src 'self' — the strictest in our suite of tools) even restricts which hosts the page may contact, so the privacy guarantee is enforced by the browser itself.

Why the redaction is permanent

Many “redaction” tools just draw a black rectangle on top of the text. That leaves the words selectable and recoverable — anyone can copy them back out. Redact does real redaction: when you apply a redaction box, the whole page is rasterized to an image with your box burned in as solid black, and that page is then rebuilt as image-only in the PDF. The original text is destroyed — there is no text layer left to extract.

A built-in Verify redaction step re-opens the result and checks that no text remains under any redacted region, so you can confirm the redaction held. We are honest about the limits: redaction is permanent and we destroy the underlying text, but you are responsible for verifying before sharing, and we make no claim about government or legal acceptance.

Auto-redact finds PII — no AI

The auto-redact feature scans the in-browser text layer with regular expressions for common, high-risk identifiers — Social Security numbers, phone numbers, email addresses, credit-card numbers and dates — and offers to burn them in with one click. It runs entirely locally. There is no AI and no text upload, which is the wedge versus tools that send your extracted text to a server.

Sign and fill, then flatten

Draw with a trackpad/mouse or type a signature, place/scale/rotate it onto a page, and it is flattened into the PDF as a static image. For forms, Redact detects AcroForm fields so you can fill them, and you can also drop a free text box anywhere on the page. The output is a flattened PDF with no live form fields.

Offline-capable PWA

Because there is no model to download and no server to call, the entire app is cached by a service worker after the first load. Install Redact to your home screen or desktop and it opens and runs with no internet connection at all — ideal for your most sensitive documents.

No tracking by default, no upload ever

There is no signup. By default this build ships with zero third-party scripts — no ads, no analytics, nothing — and the strict connect-src 'self' CSP enforces that. Ads (Google AdSense) and cookieless analytics (Plausible) are wired as two independent, environment-gated flags that an operator opts into at deploy time; both stay off in the default build, and the on-device privacy promise for your documents is never traded away. Even with analytics on, events carry only coarse counts (pages, redaction count, PII match count) — never your PDF text or pixels.