AnonymFilesCheck that a PDF is really anonymized: 6 tests before you send it
To check that a PDF is really anonymized, run six tests on the file itself: copy and paste under the blacked-out areas, a search for the names, metadata, hidden layers, file name, extracted text. If a name reappears, the file does not go out.
Before you start: test the right file
Test the file that will go out, once it has been closed and reopened. In Preview, a redaction stays editable while the document is open and becomes permanent when it is closed. In Acrobat Pro, the redacted and sanitized document is saved as a new file: that is the one to check.
Then write down what must no longer appear: names, companies, addresses, emails, phone numbers, case numbers. Tools used: Preview (Mac), Acrobat Reader, free on Mac and Windows, and three free command-line tools, exiftool, qpdf and pdftotext. The redaction itself is covered in redacting a PDF on a Mac with Preview or Acrobat.
Test 1: copy and paste the text under the blacked-out areas
Why. A black box drawn on a page hides the text without removing it: it can still be selected underneath. That is the trap described in why a black box leaves the text readable.
How.
- On a Mac, in Preview: Tools › Text Selection, drag the pointer over each black area, overlapping a little, then Edit › Copy, and paste into TextEdit.
- On Windows, in Acrobat Reader: right-click the page, Selection Tool, same gesture, right-click the selection, Copy, then paste into Notepad.
A copy restriction prevents this test, but does not remove the text from the file.
What must be true: the paste contains no hidden passage; in its place, nothing, or a label such as [PERSONNE_1]. Otherwise, go back to the original and use a tool that deletes the text (“Redact a PDF” in Acrobat Pro, “Redaction selection” in Preview), as explained in redacting a PDF reliably.
Test 2: search for each name and its variants
Why. A manual redaction easily misses an occurrence: a header, a footnote, an appendix, a name written differently. Search finds them, provided you search for every form.
How. For each person, search for the last name alone, the first and last name, the initials, the name in common use, the form without accents, the email address, the phone number written several ways (06…, +33 6…) and the case number. Also search for the first letters of the name: they catch a name split at the end of a line or misspelled.
- On a Mac: the search field in Preview's toolbar.
- On Windows, in Acrobat Reader: Ctrl + F (Command + F on a Mac) opens the Find bar. Advanced search (Edit › Advanced Search) extends it to comments and bookmarks.
What must be true: zero results for each term, in the pages, comments and bookmarks.
Test 3: read the metadata (properties and XMP)
Why. A PDF keeps properties that the screen does not show: title, author, subject, keywords, creating application. They can exist twice, in the document properties and in an XMP block. A title such as “Conclusions DUPONT v. MARTIN” survives the redaction of the pages: as Acrobat's help puts it, redaction “only removes the visible text and images” (our translation).
How.
- On a Mac, in Preview: Tools › Show Inspector shows the author, among other fields, and the keywords inspector shows the keywords.
- On Windows and on a Mac, in Acrobat Reader: right-click, Document Properties, Description tab. In Acrobat, the Additional Metadata button, then Advanced, shows the embedded metadata.
- On the command line, with exiftool (free, for Mac and Windows):
exiftool -a -G1 file.pdflists everything, group by group: [PDF] for the properties, [XMP-…] for XMP. Careful: Creator means the software in the PDF group, but the author in the XMP-dc group. On Windows, dragging the PDF onto exiftool(-k).exe also displays the list.
What must be true: no name or case reference in these fields; the software name can stay. If the metadata was cleared with exiftool, the file must have been rewritten afterwards, for example with qpdf --linearize input.pdf output.pdf: the exiftool documentation warns that “ExifTool alone may not be used to securely edit metadata in PDF files”. Without rewriting, the old values remain in the file, even when exiftool no longer shows them. To fix it, see remove a PDF's metadata, or “Sanitize document” in Acrobat Pro.
Test 4: open the hidden layers
Why. A PDF carries more than its pages: comments and annotations, which carry an author name, form fields, attachments, hidden layers, bookmarks. Acrobat's help lists them among the “types of data that can be hidden”. And Apple points out that, in Preview, table-of-contents entries “that link to redacted text are not removed” (our translation).
How.
- On Windows and on a Mac, in Acrobat Reader: open the Comments, Bookmarks, Attachments and Layers side panels one by one. If they are missing: Menu › View › Show/Hide › Side panels (View › Show/Hide › Side panels on a Mac). A purple message bar signals fields to fill in.
- On a Mac, in Preview: the annotations inspector lists the annotations, and View › Table of Contents shows the PDF's bookmarks.
- On the command line:
qpdf --list-attachments file.pdflists the attachments. - In Acrobat Pro: All tools › Redact a PDF › Sanitize document › Remove selectively shows the hidden information found, to tick for removal.
What must be true: no comments, no attachments, no filled-in fields, no hidden layers, and bookmarks without names. Also look at the links: an email address or a file path can contain a name.
Test 5: check the file name and its path
Why. The file name travels with it: it shows in an email attachment and in the conversation when you drop the PDF into an AI. “Conclusions DUPONT v MARTIN v3.pdf” undoes the whole redaction. If you send a folder, the name of each subfolder goes with it.
How.
- On a Mac, in the Finder: select the file and press Return to rename it; View › Show Path Bar shows the folders that contain it.
- On Windows, in File Explorer: F2 renames the selected item, Alt + Enter shows its properties.
What must be true: a neutral name (document-03.pdf), in a folder with a neutral name, and a document title (test 3) that does not repeat the old name. It is better to produce the copies in a new folder than to rename the originals.
Test 6: reread the text the AI will read
Why. An AI reads the text of the file, not just the page on display. For a PDF, with its vision-capable models, the OpenAI API “extracts both text and page images and sends both to the model”: the text and the image of the pages. Anthropic's documentation describes the same thing for Claude. And this extracted text also includes what the screen does not show: transparent text, text covered by other content or in the background color.
How. Extract all the text, then read it from start to finish, headers, footers and appendices included.
- On a Mac: pdftotext, from the free Poppler suite (with Homebrew:
brew install poppler). The commandpdftotext document.pdfcreates document.txt next to the PDF; the-layoutoption roughly preserves the layout. - On Windows, in Acrobat Reader: Edit › Copy File to Clipboard, then paste into Notepad. Another route: File › Save As Other › Text.
What must be true: the text reads in full without a name, number or detail that would identify someone. Run the test 2 search on it again. This is also where indirect identifiers show up: a place, a precise date, a unique job title. The rest of the process is in anonymize a document before sending it to ChatGPT.
The 6 tests in one table
| Test | On a Mac | On Windows | What must be true |
|---|---|---|---|
| 1. Copy and paste under the black areas | Preview, Text Selection, Copy | Acrobat Reader, Selection Tool, Copy | No hidden passage in the paste |
| 2. Names and variants | Preview's search field | Ctrl + F, then Advanced Search | Zero results, comments and bookmarks included |
| 3. Metadata | Preview's inspector, exiftool | Document Properties, exiftool | No name in the properties or the XMP |
| 4. Hidden layers | Annotations inspector, table of contents | Comments, Bookmarks, Attachments, Layers panels | Nothing hidden that identifies someone |
| 5. Name and path | Finder: Return, Path Bar | File Explorer: F2, Alt + Enter | File and folder with neutral names |
| 6. Text read by the AI | pdftotext document.pdf | Copy File to Clipboard | Read in full, with no direct or indirect identifier |
Scanned PDFs: no text, except an OCR layer
A scan is an image: without a text layer, tests 1, 2 and 6 find nothing, which proves nothing. Two traps. First, a scanner or OCR software may have added an invisible text layer under the image: if copy and paste or pdftotext returns text, that layer exists and must be redacted like a text PDF. Second, the AI also receives the image of the pages: a name readable in the image can be read. The masking must therefore be burned into the image, and tests 3, 4 and 5 still apply. The complete method is in anonymize a scanned PDF or a photo of a document.
What AnonymFiles does, and why reviewing is still necessary
AnonymFiles is a desktop app, coming soon for Apple silicon Macs and Windows, that redacts an entire folder on your computer: text and scanned PDFs, images, Word (.docx), emails (.eml, .msg), spreadsheets (.xlsx, .csv), presentations (.pptx), .txt and .md. At export, it takes care of what several of these tests check. Hidden content is actually deleted, not covered. Metadata, annotations, forms and links are removed. The copies land in a new folder, with neutral file names and an index of the documents exported and excluded; the mapping table between labels and real names stays on your computer, never in the export. A PDF is exported as a PDF with the same layout: each hidden passage becomes a black block carrying its label, and the text underneath is deleted; a Word file becomes a redacted .docx that keeps its layout. The details are in what an AnonymFiles export contains and on the security and network scope page.
Reviewing is still necessary. Detection finds people's names, organizations, addresses, emails, French-format phone numbers, IBANs from nine European countries, private dates and identification numbers. No detection is perfect, and amounts are masked by hand, in one click, during review. Each document is reviewed side by side with the original, and nothing is exported without approval. On the export, the name search and the full read (tests 2 and 6) therefore remain essential. Scans are read by local OCR: a stamp or handwritten note the OCR cannot read is masked during review.
Frequently asked questions
How can I tell whether a redacted PDF leaves text visible?
Open the final file, select the text on and around each black area, copy it, then paste it into a text editor. If a hidden passage appears, the redaction failed. Follow up with a search for the names and by extracting the full text, for example with pdftotext.
Is a copy-protected PDF anonymized?
No. A copy restriction prevents copy and paste in a PDF reader, but it does not remove the text from the file. Only a redaction that deletes the text, checked with the six tests, protects the content.
Should I run these tests again on a file produced by anonymization software?
Yes, at least the name search and a full read of the extracted text. No automatic detection is perfect: a misspelled name, a case number or a precise date can slip through.
Can a scanned PDF contain hidden text?
Yes. A scanner or OCR software can add an invisible text layer under the image. If copy and paste or pdftotext returns text, that layer exists: it must be redacted like a text PDF, in addition to the image.
What should I do if one of the tests fails?
Do not send the file. Go back to the original, redo the redaction with a tool that deletes the text, clean the metadata and hidden layers, give the file a neutral name, then run the six tests again on the new version.