Drag a box over any name, account number or address and black it out, pixelate it, or blur it — per region. Reveal mode flips it: hide everything and show just one field. The redaction is baked into the pixels and the metadata is stripped, so it can't be undone.
Most redaction tools upload your document to a server first — a non-starter for anything under HIPAA or an NDA. Redact runs entirely in your browser. The file never leaves your device. Turn on airplane mode and it still works.
Drop in a PDF or image. Drag a box over each sensitive region and pick black box, pixelate, or blur. Or use reveal mode to obscure the whole page and expose a single field.
On export the page becomes an image-only PDF with the hidden areas burned in and metadata stripped. Unlike a moveable black box, there's no text or layer underneath to copy out or drag away.
All of it happens on your device, in the browser. Your document is never transmitted, stored, or trained on. Cut the wifi and Redact keeps working — that's your proof it's local.
Before a contract, deposition exhibit or discovery packet goes to opposing counsel or the court, privileged names, account numbers and SSNs have to come out for good. Redact bakes each black box into the page and exports an image-only PDF, so there is no annotation layer that an associate on the other side can delete to reveal what was underneath. And because nothing is uploaded, the privileged document never touches a third-party server.
Not every firm has an enterprise document system with a hardened redaction module, but the duty of confidentiality is the same. A solo attorney can redact a client agreement or settlement figure in the browser, on their own laptop, and email the flattened result with confidence that the figure cannot be recovered. "Never uploaded" is the part you can put in writing to a client.
Sharing an intake form, an EOB, or a disciplinary record often means hiding one patient's or employee's identifiers while keeping the rest legible. Reveal mode obscures the whole page and exposes only the field you need to show, and the export strips metadata so a hidden author name or scan timestamp does not leak. For HIPAA-covered data, keeping the file on-device sidesteps the question of a business-associate agreement with an upload service entirely.
When a bank statement or invoice has to go to an auditor, a vendor, or a screenshot in a deck, the account and routing numbers usually need to disappear. Black-box those regions and export, and the digits are gone from the pixels rather than sitting beneath a movable shape. Batch mode on Pro lets you run a stack of statements and download them as a single ZIP.
The common way tools "redact" a PDF is to draw a black rectangle as an annotation on top of the page. The text and images underneath are untouched — they can be copy-pasted straight through the box, or recovered by simply deleting that top object in any editor. This is exactly how real redaction failures have leaked names in court filings. Redact does the opposite: it rasterizes each page so text, vectors and images all collapse into pixels, burns the obscured regions destructively into those pixels, then rebuilds a brand-new image-only PDF. The original content streams, fonts and text layer are never carried into the output, so there is literally nothing left underneath a box to peel off.
Each page is rendered to a canvas with pdf.js, the redaction is composited in (a solid fill for black box, or a genuinely lossy mosaic and blur for pixelate), and the page is re-embedded as a flat JPEG in a fresh PDF built by pdf-lib with neutral, empty metadata. Pixelate is not a reversible filter — the region is shrunk to a few cells and scaled back up with smoothing off, so the original detail is destroyed, not just scrambled. The deliberate cost is that the exported PDF has no selectable text and pages are image-based; that is the correct trade for a guarantee that the hidden data is gone. If you need a searchable document, redact a copy and keep your editable original.
For anything under HIPAA, an NDA, or attorney-client privilege, the moment a document is sent to a redaction server you have created a disclosure you have to account for. Redact runs entirely in your browser with a pure Canvas engine and a local PDF worker, so the file is never transmitted, stored, or used for training. The verifiable proof is airplane mode: turn off your network and every mode still works, because there was never a round-trip to begin with. That means no business-associate agreement to chase and no "where did our document go" question to answer.
No. Redact runs entirely in your browser, so the PDF or image never leaves your device — nothing is uploaded, stored, or trained on. You can switch to airplane mode and it still works, which is the proof it's truly on-device.
Permanent. On export the page is flattened to an image-only PDF with the hidden areas baked into the pixels and metadata stripped. There's no underlying text or moveable layer to copy out or drag off, so it can't be reversed.
Yes, there's a generous free tier with no signup to try. Pro is $9/mo or $69/yr and unlocks full resolution, batch with ZIP export, no watermark, and unlimited history across every nimbril tool, or $4/mo for just this app.
Yes. Redact works on images and PDFs alike, including scans. Because output is image-based, scanned pages and photos are handled the same way as native PDFs.
Black box fully covers a region with solid black, pixelate scrambles it into blocks, and blur softens it out — choose per region. For sensitive data, black box on an image-only export is the safest because the content is gone, not just hidden.
No, and that is intentional. To guarantee the redaction can't be reversed, each page is flattened to an image, so the output is image-only with no text layer to select or search. If you need a searchable copy, keep your original editable file and only share the flattened redacted version.
Yes. Because the output is a brand-new document rebuilt from flattened images, none of the source PDF's metadata, fonts or content streams carry over, and the new file's title, author and keywords are set to empty. Hidden details such as the original author name or creation timestamp don't survive the export.
Pixelate and blur are applied destructively to the pixels, not as a reversible filter — the region is downsampled and the original detail is genuinely discarded, so it can't simply be "un-blurred." That said, for the most sensitive data like SSNs or account numbers, a solid black box is the safest choice because there is no residual structure left at all. Pick black box when the content must be unrecoverable.
Yes, on Pro. Batch mode lets you run multiple PDFs or images through the same redaction and download them together as a ZIP, which is useful for a stack of statements or a set of exhibits. Everything still happens on your device — batching doesn't send anything to a server.