2026-09-11

Blacking out a PDF before you share it? Covering text is not the same as deleting it

In January 2019, lawyers for Paul Manafort filed a court document that blacked out several passages before submitting it. The black bars did not work: anyone could select the covered text, copy it, and paste it into a blank document to read it in full. What came out was that Manafort had shared campaign polling data with Konstantin Kilimnik, a man tied to Russian intelligence, and discussed a Ukraine peace plan with him — reported within hours by BuzzFeed News and Motherboard. The mistake was not exotic. It is the single most common redaction failure there is, and it keeps recurring in public documents seven years later, because a black box and a delete key are not the same tool. This post is about the difference — what a black box actually does to a file, why encrypting the same file does something structurally different, and where NearSeal fits once you know which problem you actually have.

The same failure, three more times since

In October 2024, Kentucky Public Radio and NPR discovered that roughly 30 pages of a redacted lawsuit against TikTok, filed by 14 state attorneys general, could be read in full by copying the blacked-out sections into another document. Among what came out: TikTok's own internal research had identified a specific threshold for habit formation in teenagers — watching 260 videos, per NPR's reporting on the unredacted text. A state judge sealed the entire complaint once the excerpts became public.

In February 2026, lawyers representing more than 200 alleged victims of Jeffrey Epstein told a federal judge that the Justice Department's document release — required by the Epstein Files Transparency Act, which passed Congress 427–1 and by unanimous consent and was signed into law on 19 November 2025 (Pub. L. 119-38) — contained what they called "thousands of redaction failures" affecting nearly 100 survivors. CNN reported one specific example: an email listing 32 underage victims where only one name had been blacked out, leaving the other 31 exposed. NPR reported that the Department subsequently withdrew several thousand documents from public view after the failures were raised in court. None of these three cases — a defense filing, a state lawsuit, a federal document production — involved a novel attack. In every one, someone drew a black rectangle over text that was still sitting there underneath it.

What a black box actually is

A "redacted" PDF is usually still the original document, with an opaque shape drawn or painted on top of the part someone doesn't want seen. The text layer, or the pixels of a scanned image, are unchanged; the black box is a separate object stacked above them. Copying the text pulls from the layer underneath the box, not from the box itself, which is why pasting it into a plain text file routinely un-hides it — no hacking involved, no software vulnerability, just select-all and paste. NSA's own guidance on the subject, Redacting with Confidence (2005, updated for Word 2007 in 2008), states the underlying principle plainly: "information hidden or covered in a computer document can almost always be recovered." Its list of the most common mistakes reads like a checklist of the cases above — covering text, tables, or images with black rectangles or black highlighting, and shrinking an image small enough that it merely looks illegible rather than actually removing the detail.

The guidance's fix is equally plain, and it is not "use a darker black" or "add a second box": "the way to avoid exposure is to ensure that sensitive information is not just visually hidden or made illegible, but is actually removed from the original document." Delete the sensitive text outright, then flatten the remaining document (so no hidden text layer or track-changes history survives underneath), rather than drawing over it and hoping the cover holds. Recent AI chatbots have made the old failure mode faster to exploit, not new: dropping a poorly redacted PDF into a general-purpose chatbot and asking it to read the text under the black bars works exactly as well as copy-paste did in 2019, because both are reading the same untouched text layer.

Where encryption does something different

Encryption doesn't fail the way a black box does, but that's because it isn't trying to do the same job. NearSeal, like any file encryptor, doesn't touch the content of a document at all — it takes the entire file as a sequence of bytes and, in its default format, runs it through AES-256-GCM with a key derived from your passphrase via PBKDF2-SHA256 (2^20 iterations, above OWASP's 2023 minimum of 600,000). Every byte comes out as ciphertext. There is no "mostly readable, except this part" mode, because there's no concept of "this part" once the whole file is one opaque blob — you either have the passphrase and get the entire original file back, or you don't and get nothing usable at all. That's a bad fit for "publish this document but keep 12 names hidden," which needs selective, permanent deletion of exactly those names and nothing else. It's a good fit for "send this entire document to one specific person, and nobody who intercepts it in transit or finds it on a shared drive should be able to open any of it" — an email attachment to your accountant, a full case file to your lawyer, an archive going to one person for one purpose. All of it happens locally in your browser; nothing is uploaded anywhere in the process.

What encrypting a file honestly doesn't do

It's not a redaction tool. If your actual task is releasing a document where most of it should stay visible and a specific part shouldn't, encrypting the whole thing is the wrong shape of solution regardless of how strong the cipher is — you need a tool that deletes the sensitive part and flattens what remains, the way NSA's guidance describes, not a passphrase wrapped around everything.

It doesn't hide the filename. NearSeal's default container keeps the original filename in its own header in the clear — readable by anyone who has the file, tamper-evident but not hidden, in the current format version — precisely so the container can be identified and named sensibly without the passphrase. "settlement_offer_jane_doe.pdf.nearseal" tells a bystander what's inside almost as plainly as the unencrypted name would. Rename a file to something generic before encrypting it if the name itself is part of what you're protecting. (NearSeal's opt-in age-encryption.org output format has no filename field at all, at the cost of losing the original name on decrypt.)

There's no passphrase recovery, ever. If you forget the passphrase on a file you encrypted, NearSeal has no reset link, no support ticket, and nothing stored on a server to fall back on, because there is no server involved in encrypting or decrypting anything. That's the same design that keeps your files from ever leaving your device — it cuts both ways.

And it stops protecting the file the moment someone opens it with the right passphrase. If the device on the other end is already compromised, or the recipient forwards the decrypted contents, or a screenshot of the opened document circulates, none of that is something a cipher can prevent — the ciphertext was never the part that was exposed.

The honest version

A black box is supposed to let a document stay mostly public while removing one part of it permanently, and it only works when the removal is real — deletion, not decoration. A passphrase is supposed to make an entire file unreadable to everyone except the person it's meant for, and it does exactly that, with no partial setting available. Manafort's lawyers, Kentucky's TikTok filing, and the Epstein files releases all failed at the first job because they used decoration where the job needed deletion. Reaching for the second tool wouldn't have fixed any of them either — encrypting the whole filing would have hidden the parts that were supposed to stay public along with the parts that weren't. Use each tool for the shape of problem it's actually built for.