ImagePDF.Tools

Auto-Redact Personal Data in a PDF

Processing securely on your device, no data sent to any server
PDF

or drop files here

Emails, phone numbers and ID numbers are spotted for you and boxed on the preview. You decide which boxes stay, and the detection runs as local code with no copy of your document sent out.

How it works

Detect, review, black out.

Drop the PDF

As soon as the file opens, every page of text is read and checked against ten patterns for personal data.

Review what was found

Matches appear as boxes on the preview, grouped by type with a count. Turn a category off, click a box to spare it, or drag in one the scan missed.

Apply and save

Selected boxes are burned into images of their pages and the underlying text is deleted. Save the copy when it is done.

Use cases

Long documents, scattered details.

Hunting for every phone number in a forty-page export is slow and easy to get wrong. Automatic detection earns its keep in files like these.

Customer exports for a contractor

A list of orders or support tickets printed to PDF is full of emails and phone numbers. Strip them before an agency or developer sees the file.

Salary slips and Form 16

Indian payroll documents carry PAN, bank IFSC and sometimes Aadhaar. Hide them before a slip goes to a rental agent or a visa file.

KYC and loan paperwork

Identity numbers repeat on every page of an application pack. One pass finds each Aadhaar or Social Security number wherever it was typed.

European invoices and remittances

Sharing an invoice as an example or in a dispute? IBANs are validated before they are boxed, so reference numbers next to them stay readable.

Server logs and incident reports

Security write-ups quote IP addresses and user emails. Remove them before the report goes to a vendor or into a public post-mortem.

A second pair of eyes

After redacting by hand, open the result here. If the scan still turns up a card number on page 14, you caught it before anyone else did.

How a check digit tells a card from a lookalike

A pattern such as "thirteen to nineteen digits" would flag every tracking code and order reference in a document. Real card numbers, though, end in a check digit chosen so the whole number passes the Luhn test. Take 4242 4242 4242 4242. Starting from the right, double every second digit: each 4 becomes 8, each 2 stays 2. Add everything up and you get 8 × (8 + 2) = 80, which divides evenly by 10, so it passes. Change the last digit to 3 and the total is 81: rejected, and left unboxed.

A random sixteen-digit string passes Luhn only about one time in ten, so nine out of ten false alarms disappear before you see them. Aadhaar numbers use the Verhoeff scheme, which also catches swapped neighbouring digits, and IBANs use mod 97, which lets through only about one random string in ninety-seven. Strings of one repeated digit, like 0000 0000 0000 0000, are always skipped, even the ones that technically pass.

What detection cannot see. Names, street addresses, a number broken across two lines, and anything inside a scanned image. That is why each match is shown for review rather than applied blindly. For names, use the Find box on this page, or switch to Redact PDF to work entirely by hand.

IdentifierValidationRandom string passes
Payment cardLuhn (mod 10)About 1 in 10
AadhaarVerhoeffAbout 1 in 10
IBANISO 7064 mod 97About 1 in 97
US SSNShape and banned ranges onlyNeeds the 123-45-6789 layout
PAN, IFSCExact letter and digit layoutNo check digit to test

When two patterns overlap, the more specific rule wins: a validated IBAN is reported once as an IBAN, never a second time as a phone number.

Common questions

Questions answered.

What kinds of personal data does it detect?
Ten kinds: email addresses, phone numbers, payment card numbers, IBAN bank account numbers, US Social Security numbers, Indian Aadhaar, PAN and IFSC codes, IPv4 addresses, and dates of birth. Each kind found gets its own switch with a count, so you can see at a glance what the document holds.
How does it avoid boxing order numbers as card numbers?
A long string of digits only counts as a card if it passes the Luhn check that every real card number is built to satisfy. Aadhaar numbers must pass the Verhoeff check and IBANs the mod 97 check used by banks. Random numbers fail these tests most of the time, so invoice references, tracking codes and phone-like serials are left alone.
Does it find names and street addresses?
No. Names and addresses have no fixed shape a pattern can rely on, and guessing would box half the page. Type each name into Find and every copy of it is boxed across the whole document, which is quicker and more reliable than guessing.
Can I keep some matches and remove others?
Yes. Switch a whole category off to keep it, for example your company switchboard number, or click a single box on the preview to drop just that one. You can also drag new boxes anywhere the scan missed.
Why did it find nothing in my scanned PDF?
Detection reads the text layer, and a scan is a photograph of paper with no text layer at all. Run OCR PDF first to add recognised text, then open the new file here. You can always draw boxes by hand on a scan without OCR.
Which phone number formats does it recognise?
International numbers that start with a plus sign, North American numbers written like (555) 123-4567 or 555.123.4567, and ten-digit Indian mobile numbers starting with 6 to 9. A local landline written without a country code or separators may slip through, so look over the pages before applying.
Are all dates on the page treated as birth dates?
No, only a date that follows a label such as DOB, D.O.B., Date of birth or Born. Invoice dates, deadlines and signature dates stay visible, which is what you want in nearly every document.
Is the black-out the same as in the manual Redact PDF tool?
It is the same engine. Every page with a selected match is rendered to an image with the boxes filled in black and swapped into the file, so the matched text is deleted rather than covered. Pages with no matches keep their selectable text.
Are the matches sent anywhere to be checked?
No. The patterns and checksum tests are plain code running in your browser tab, and the redacted pages are assembled by a Web Worker on your computer. Nothing about the document, including what was found, reaches our servers.