A black box isn't redaction. From the Manafort filing to the Epstein files, "redacted" documents leak because the text is still under the box — one copy-paste away. BlackoutPDF destroys the words themselves, rebuilds the file from flat pixels, and never uploads a byte. Don't believe it? Turn off your Wi-Fi — it still works.
The privacy model isn't a policy you take on faith — it's behavior you can observe in your own browser, right now, with tools you already have. Five tests, no signup.
Open DevTools → Network, then load, redact and export. Count the requests carrying your document. The count is zero.
Load the page, then kill your connection entirely. Redacting, exporting — everything keeps working. A server-based tool can't do that.
The exported file is re-rendered to flat images. There is no text layer left under the black — nothing to select, copy, or recover.
Author, edit history, hidden layers, embedded scripts and tracking metadata from the original do not survive the export.
pdf.js and canvas run in your device's memory. The file is opened, processed and saved locally — it never reaches a server because there is no server.
A Content-Security-Policy ships with every page instructing the browser itself to refuse outbound connections that could carry your file. Read it in View Source.
In 2,000+ documented incidents — court filings, government releases, corporate reports — someone "redacted" a PDF by drawing a black rectangle over the text. The text was still there. Anyone could select it, copy it, and paste it into a notepad.
BlackoutPDF takes the only approach that cannot leak: it re-renders your document into flat images, burns the redactions into the pixels, and builds a brand-new PDF. The original text layer, hidden layers, and metadata are simply not in the file anymore.
And because all of this happens inside your browser tab, there is no server to breach, no upload to intercept, no "we delete files after 2 hours" policy to take on faith.
Black out names, exhibits, privileged passages and PII before discovery production or a public filing.
→ Court bundles · discovery · exhibitsRemove SSNs, salaries and home addresses from offer letters and personnel files before they're shared internally.
→ SSNs · compensation · recordsRedact account and routing numbers from bank statements and tax documents before sending to a client or portal.
→ Statements · returns · K-1sClean cap tables, investor updates and employee documents before forwarding to a partner or new hire.
→ Cap tables · diligence · contractsRedact loan documents, IDs and financial disclosures before they pass between buyer, seller and lender.
→ Loan docs · IDs · disclosuresStrip patient identifiers from non-clinical files before sharing with vendors, auditors or counsel.
→ PHI · intake forms · billingDestroy sensitive content — burned into pixels, not hidden under boxes.
You're here ●Draw or type a signature and place it on any contract. Text stays intact.
Open →Combine and reorder PDFs losslessly. Court bundles, client files, scans.
Open →Shrink a PDF to fit any portal or inbox — without mailing it to a server farm.
Open →Images to PDF and back. EXIF and GPS metadata don't survive the trip.
Open →There is no endpoint that ingests documents. The only request this site ever makes with data is a license check that sends a Stripe session ID — never your file. Everything else is libraries and fonts.
Every page ships this Content-Security-Policy. It's an instruction to the browser, not a pledge from us — it names the only places the page may connect, and your document isn't one of them.
Your document is transmitted to their servers and "redacted" with a box drawn over still-extractable text. You can't watch it happen, can't work offline, and the words are recoverable with a copy-paste.
Same drag-and-drop, opposite architecture. Processing is local and verifiable in DevTools, works with the network off, and redaction is destructive — the text is gone, not hidden. No upload, no account, and nothing to install or self-host — just open the page.
Adobe Acrobat Pro $19.99 / month · Smallpdf Pro $9 / month · iLovePDF Premium $6.61 / month
BlackoutPDF Pro $19 / year (everything) · Team $99 / year — still a fraction of Acrobat, and your documents never leave the room.
Three ways. (1) Open DevTools → Network tab, load your PDF, redact, export — you'll see zero requests carrying your data. (2) Load this page, then turn off Wi-Fi entirely; the app keeps working. (3) Read our Content-Security-Policy header: the browser itself is instructed to refuse connections with your data.
Yes — it's the approach security teams recommend for true sanitization. Box-over-text redaction has leaked sensitive data in court filings and government releases for decades, because the text remains in the file. Flattening to pixels makes recovery physically impossible. The trade-off: text in the exported PDF is no longer selectable (it's an image), which for a redacted document is usually exactly what you want.
It doesn't survive. Your exported file is built from scratch, so author names, edit history, hidden layers, embedded scripts, and tracking metadata from the original are gone.
The free tier handles documents up to 3 pages here (up to 10 in some tools), forever. Pro is $19/year and unlocks everything — unlimited pages, files and documents across all five tools, plus every superpower: Auto-Redact, batch compress & convert, the signature library, and Bates stamping, on every device you own. That's less than one month of Acrobat Pro, with nothing held back. Team is $99/year and covers your whole team with one license key, commercial-use rights, and priority support. Prefer not to subscribe? A one-time $49 Pro Lifetime license unlocks everything forever — no recurring charge. No account either way — your license key is your receipt.
The same way everything else here works: in your browser tab. Auto-Redact reads the text layer of your PDF locally and tests it against patterns for SSNs, emails, phone numbers, account numbers, and any custom terms you add. Matches become ordinary redaction boxes — you review, adjust or remove them, then export. Neither the document nor your patterns ever leave the tab.
That's the core use case — it's safer than any upload-based tool precisely because there's no server involved. (Standard disclaimer: review your export before sending, and check your organization's compliance requirements.)
Yes — and it still can't upload your file. Where your browser supports the new WebMCP standard (navigator.modelContext — in origin trial in Chrome and Edge today, others to follow), an AI agent can drive the redactor for you: check the document, black out SSNs and emails, export the flattened file. It calls the same in-tab functions the buttons do, so nothing leaves your browser. On browsers without it, the feature simply isn't there. And we will never offer an "agent API" that uploads your document — that would defeat the entire point of this tool.
The free tier covers documents up to 3 pages. Pro unlocks unlimited everything for less than one month of any competitor's subscription.
Already purchased? Restore license
No account needed — recover it either way.
Active on this device. Two no-account ways to get back in later:
Lost it? Restore anytime with the email you bought with — or your key (cs_…), also in your Stripe receipt.