Redact a PDF, and prove nothing is left.

Most PDF libraries can remove the text under a box. That is not the same as the secret being gone: it can also sit in the metadata, a bookmark, a form field, an attachment, or the copy of the file from before it was edited. nupdf redact goes after those, rewrites the file, then searches what it wrote.

Use it

$ nupdf redact statement.pdf -o clean.pdf --text "ACME-4471" --preset email --preset phone
$ nupdf verify clean.pdf --text "ACME-4471" --preset email --preset phone

• Targets: --text, --regex, --preset (such as email and phone), --region, --id for a content id, or --hits with a search report of the same file.
• A plan first: --dry-run reports what would be removed and writes nothing; with --preview DIR it draws each page with the areas shaded.
• Black boxes only if you ask: --boxes. By default the text is removed and nothing is drawn over it.

What it removes

• The text, image pixels and line art under each target, as MuPDF's redaction does.
• Text no viewer shows: invisible text, text outside its clip, and layers that are switched off.
• The same words in the metadata, outline titles, named destinations, form values, annotations, structure text, JavaScript and attachments.
• Earlier revisions. The output is always a full rewrite, so the file from before the edit is not left inside it.

What it checks afterwards

Before the output is kept, nupdf opens it and looks for every target again in ten places: page text, structure, annotations, metadata, the outline, embedded files, hidden content, images, the file's history and JavaScript. The report says how many hits each target had before and after.

If anything is still there, it exits 4 and writes no file. nupdf verify runs the same check on any PDF, including one another tool redacted.

How it has been tested

• On a suite of files built to leak, one hiding place each, and on a public redaction benchmark: no leaks, as judged three ways, by nupdf verify, by MuPDF's text extraction and by pdftotext.
• Files seeded to leak are caught by verify.
• The text left after redaction matches MuPDF's own redaction on 5,052 of 5,066 files, 99.72%.

What nupdf promises about redaction, and what it does not, is in the threat model. The numbers are from RESULTS.