Redact a PDF for free without uploading it

A judgment, an expert report or a payslip has to leave the file: for a colleague, an AI tool, a training session or a publication. Before it does, the names and identifiers must go. Most online "redact PDF" services start by asking you to upload the document. For a Belgian lawyer, that upload is already a disclosure: the file leaves the firm and lands on servers you do not control, under terms of use you would have to read and accept.

This guide explains what real redaction is, why the familiar black rectangle so often fails, and how to redact a PDF locally, in your browser, without sending it anywhere.

Why a black box is not redaction

A PDF is not a photograph of a page. It usually contains several layers of information:

• a text layer: the characters, their position and their font. This is what you select, copy and search;
• drawings and images placed above or below that text;
• document properties (title, author, application, sometimes the company) and XMP metadata;
• annotations, comments, form fields and attached files;
• after an incremental save, earlier versions of the content, appended to the same file.

Drawing a black rectangle, or highlighting in black, adds a shape on top of the text. The page looks redacted, but the characters are still there. Select the area, copy it, paste it into a text editor, and the name reappears. Search engines, AI tools and screen readers read the text layer, not the picture.

Common failures:

• a black highlight or a rectangle annotation placed over the text;
• a scan that the copier made "searchable": the image is blacked out, but the invisible OCR text underneath still contains the name;
• names left in headers, footers, bookmarks or the document title;
• an author field that carries the client's name;
• margin comments that quote the other party;
• the file name itself, such as Conclusions_DUBOIS_v_PEETERS.pdf.

What real redaction means

Real redaction removes the information instead of covering it. Two methods are reliable:

1. Rebuild the document from its text. The text is extracted, every name or identifier is replaced in the text itself (by a token such as [PERSON_1] or by a black bar), and a new PDF is written. The text stays selectable; the original layout is simplified.
2. Rasterise the pages. Each page becomes an image, the black boxes are painted into the pixels, and a new PDF is assembled from those images. No text layer is left, so nothing can hide under the boxes. The price: the text can no longer be selected or searched, and the file is larger.

In both cases the metadata, annotations, attachments and form fields of the source file must be removed as well.

Why "without uploading" matters for a lawyer

Professional secrecy covers the document, not only the names in it. The joint AI guidelines of the Orde van Vlaamse Balies and AVOCATS.BE (20 January 2025) ask the lawyer to read the terms of use of an AI tool before using it, with attention to training, transfer and storage, the location of the processing and whether the system is open or closed. They also ask the lawyer never to enter information covered by professional secrecy into an AI tool, unless the lawyer is absolutely certain of working in a closed environment with adequate safeguards (OVB/AVOCATS.BE guidelines, sections 1.1 and 1.2).

The same reflexes apply to any online service that receives a client document. Such a service is, in principle, a processor under the GDPR: the processing must be governed by a contract that sets out its subject matter, duration and purpose (GDPR, art. 28(3)). A tool that works entirely in the browser avoids the question: the file is read into your computer's memory and processed there. You can check it yourself with the browser's network panel, or by going offline before loading the document. The security page describes both checks.

How to redact a PDF with Localex

1. Open the tool and drop the PDF (up to 50 MB and 300 pages). The file is read in this browser tab only, and the "Data sent" meter stays at 0 bytes.
2. In What to mask, every category is ticked by default: persons, identifiers (national register number, BCE/KBO, IBAN, structured communication…), contact details, dates, organisations and sensitive data. Untick only what may stay in clear.
3. Review the findings highlighted in the text. Keep a false positive in clear, or select a word the detection missed and choose Mask every occurrence.
4. Choose the output: PDF, redacted original layout (pages turned into images with black boxes) or PDF, rebuilt text (a clean PDF with selectable text).
5. Leave the cleaning options ticked: author, company and other metadata, comments and annotations.
6. Tick I have read the result and export. Before the download, a leak scan re-reads the output file and searches it for every original value. If one is found, the download is blocked until it is masked.

A scanned PDF has no text layer, so the text must first be recognised (OCR). OCR is one of the AI features, free after e-mail verification, and it also runs on your computer.

Which output to choose

Check the result yourself

A tool does not replace a last look before sending. Four checks take two minutes:

• Open the exported PDF, select everything (Ctrl+A), copy, and paste into a text editor. Search for the surname, the national register number and the IBAN.
• Open the document properties and read the title, author, subject and keywords.
• Look at what is not text: a stamp with a name, a signature, a letterhead logo with an address, a photographed identity card. Without OCR, no detection can read an image.
• Rename the file before sending it.

Honest limits

• Detection assists you; it is not exhaustive. Belgian identifiers with a checksum (national register number, BCE/KBO, IBAN, structured communication) are recognised reliably when they are well formed. Names written in unusual ways, nicknames, or indirect details such as a rare profession, a small village or a unique event can remain. The review is yours.
• Images embedded in the PDF are flagged, not read, unless you run OCR. You can remove them, or keep them after checking them.
• A rasterised PDF is harder to use for people who rely on a screen reader. If that matters, send the rebuilt text version.
• The lawyer remains responsible for what is sent, as the bar guidelines point out (section 1.3).

Related guides

• How to pseudonymise a document before using ChatGPT
• The Belgian national register number: structure and masking
• Publishing a judgment or article: pseudonymising the parties
• How the tool keeps your documents on your computer