How to anonymize a PDF (for free, without uploading it)

Anonymizing a PDF: what it really means

Anonymizing a document means removing everything that makes it possible to identify a natural person, directly (name, email, phone) or indirectly (a file number, an address, a combination of details that ends up pointing to someone). In practice, these identifiers are often replaced with stable labels such as “[PERSONNE_1]” or “[ORGANISATION_1]”, repeated identically wherever the identifier appeared: the document stays readable and consistent for a third party who does not need to know the real identities. As long as a table makes it possible to recover the real names, it is pseudonymization, not yet anonymization within the meaning of the GDPR.

It is different from redacting a PDF, which hides a specific passage without necessarily replacing it with a readable label. Redaction is often one step of anonymization, but anonymization goes further: it covers the whole document and usually comes with cleaning the metadata (author, company, revision history); see how to remove a PDF's metadata.

There is also a frequent confusion with pseudonymization, which replaces identifiers with a code whose key is kept somewhere. Pseudonymized data remain personal data within the meaning of the GDPR, whereas anonymous data fall outside its scope. Details in anonymization or pseudonymization: the difference under the GDPR. Before choosing a method, ask yourself whether the result must be irreversible, or only hidden for a one-off use.

Anonymizing a PDF for free with Preview on a Mac

On a Mac, Preview lets you redact a PDF for free, without installing anything or uploading it: on a copy of the file, choose Tools → Redact, select each name, address or number to hide, then save and close the document. Preview detects nothing automatically, and a rectangle drawn with the shape tool leaves the text readable underneath, even after exporting or printing to PDF: always reopen the final file and run the copy-and-paste test. The step-by-step guide, and the fallback if the tool is missing in your version, are in redacting a PDF on a Mac: Preview, Acrobat and alternatives.

Anonymizing a PDF with Adobe Acrobat

Adobe Acrobat Pro has a real redaction tool, called “Redact” in the English interface: you mark the passages, if needed with a keyword or pattern search (email, phone), then you apply, which actually deletes the marked content; the “Sanitize document” option also removes metadata and hidden information. It is reliable provided you go all the way to applying, not just marking, but it is reserved for paid subscriptions. The step-by-step guide is in redacting a PDF with Adobe Acrobat.

LibreOffice and online tools: what they are worth

LibreOffice Draw, free and cross-platform (Mac, Windows, Linux), also has a Tools → Redact tool: its redacted export produces a PDF whose pages are images, which can therefore no longer be searched or copied, and nothing is detected automatically. Drawing simple black shapes and then exporting to PDF, however, leaves the text readable underneath. The procedure is in redacting a PDF with LibreOffice or online.

Online tools such as Smallpdf, iLovePDF or UPDF offer redaction or PDF editing features in a few clicks, with nothing to install. That is honestly handy for occasional use on a document that contains nothing sensitive. But the very principle of these services means sending your file to a third-party server, which raises a real question as soon as the PDF contains personal data, a client file or a confidential document: you add a processor to the chain, with its own terms of use and its own retention policy. We compare these approaches in detail in anonymizing a PDF online or offline: which to choose?

Local PDF anonymization software, to go faster

If you anonymize documents regularly, spotting every name by hand becomes slow and risky: miss just one and the anonymization is incomplete. That is the problem solved by offline PDF anonymization software: it automatically detects people, organizations, addresses, emails, phone numbers and IBANs, then replaces them with stable, consistent labels throughout the document (the same [PERSONNE_1] wherever that person is mentioned).

AnonymFiles works on this principle: it is a desktop application, coming soon for Apple silicon Macs and Windows. It reads PDFs, text or scanned (local OCR), Word files (.docx), emails (.eml, .msg), spreadsheets (.xlsx, .csv), presentations (.pptx), images and .txt and .md files; the copy of a Word document is a redacted .docx that keeps its layout, without comments, tracked changes or images, together with a text file for the AI. You drop in an entire folder, subfolders included, the app detects the information to process, you compare the original and the anonymized copy side by side and approve document by document, you can redact by hand anything that was missed (amounts, for example, are masked by hand), then you export copies with neutral file names and an index of exported and excluded documents. In the PDFs it produces, the redacted text is actually deleted, and metadata, annotations, forms and links are removed. On a scanned PDF or an image, local OCR reads the page, the pixels of the detected areas are erased in the image and an invisible text layer carries the labels.

What sets it apart: once installed, the application works offline. No account, no online license check, no telemetry, no cloud AI chat. On a Mac, the detection models are included and the application connects to nothing; on Windows, they are downloaded once, on first processing, without any document text. Everything is described in the detailed network scope. The originals are never modified, and an MCP server is announced for AI agents such as Claude: it will only expose the redacted copies to them. As with any automatic detection, a human review is still needed before distribution.

It is not the only serious option: Adobe Acrobat Pro does the job if you already have the subscription, and the free methods are enough for a single document. The advantage of a tool like AnonymFiles shows mainly from a few dozen pages onward, or when several files must be processed at once with labels that stay consistent across them.

The pitfalls that make an anonymization useless

Whatever method you choose, several mistakes come up often and cancel out all the work:

• Stopping at visual marking. A rectangle, a highlight or an annotation placed on a PDF leaves the original text intact underneath, selectable and copyable, even after exporting or printing to PDF. Only a real redaction tool, or converting the pages to images, removes it. This is the mistake that made the Manafort case famous: see black box on a PDF: why the text stays readable.
• Forgetting the metadata. The author's name, the company, the revision history or hidden comments can remain in the file's properties while the body text is clean. See removing a PDF's metadata.
• Ignoring scanned pages. On a scanned PDF or a photo, there is no text to search until OCR has been applied: a rectangle placed as an annotation on a scanned PDF does not change the image underneath and can be removed, not to mention any OCR text layer. See anonymizing a scanned PDF or a photo of a document.
• Processing only part of the document. One identifier forgotten in a footnote, a header or an attachment is enough to re-identify a person from the rest.
• Never reviewing the result. No tool, human or automatic, is 100% reliable. The final check is still selecting the text by hand in the final document.

Anonymizing an entire case file, not one PDF at a time

Manual methods work well on a single document, but not at the scale of a case file of several dozen files, where the same person may be cited ten times with spelling variants. Keeping a label consistent from one file to the next, by hand, quickly becomes a source of errors. Yet that is the daily reality of a law firm's case documents, a notary office's deeds or an accounting firm's client files.

This use case is what justifies software able to process an entire case file in one go, with the same label number for the same person across every file in the set. Useful for lawyers and legal professionals preparing documents before sending them, a case covered in anonymizing a judgment or case documents: a guide for lawyers and legal professionals, or for sending a document to an AI without exposing confidential data to it; see anonymizing a document before sending it to ChatGPT or an AI.

What the GDPR says about a truly anonymous document

The GDPR distinguishes two notions that everyday language often confuses. Article 4(5) defines pseudonymization as processing that replaces identifying data with a reference, but remains reversible using information kept separately: pseudonymized data remain personal data, subject to the regulation. Conversely, Recital 26 states that data rendered anonymous, where the person is no longer identifiable by any reasonable means, including by cross-referencing, fall outside the scope of the regulation.

This is not theoretical: failing to comply with the GDPR exposes you to fines of up to €20 million or 4% of annual worldwide turnover, whichever is higher (Article 83). In France, the CNIL (the French data protection authority) is the competent supervisory authority. A document merely redacted on screen, with no guarantee that cross-referencing cannot lead back to the person, legally often remains pseudonymized rather than anonymous. Details in anonymization or pseudonymization: the difference under the GDPR.