How to Redact Scanned PDFs (OCR Redaction Guide)

April 11, 2026|7 min read

The Lex Cloak workspace scanning a sample patient intake form — matches grouped by category in the sidebar, every sensitive field outlined in red on the page

Scanned PDFs are fundamentally different from digital PDFs, and most redaction tools fail to handle them. When you scan a paper document, the result is an image with no underlying text data. Standard redaction tools have nothing to work with. But there's a deeper problem: many scanners automatically add an invisible OCR text layer on top of the image. You redact the visible pixels, but the sensitive data remains in the hidden text layer.

Why Scanned PDFs Are Different

PDFs are structured in layers. A digital PDF from Word or Google Docs contains a text layer (searchable data) and a rendering layer (how it looks). A scanned PDF is just an image—pixels only. No text layer. No searchable content. Some scanned PDFs are hybrid: an image with an invisible OCR text layer added on top.

Layer Type	Digital PDF	Scanned PDF	Hybrid (Scanned + OCR)
Text Layer	Yes	No	Hidden
Image Layer	No	Yes	Yes
Searchable	Yes	No	Yes (but dangerous)

The Hidden OCR Layer Problem

This is where redaction failures happen. You open a scanned PDF, draw a black box over a social security number, and it looks gone. But if the PDF has an OCR layer, the actual SSN data is still there underneath the pixels. Someone with the right tool can extract it.

This isn't theoretical. Government agencies and law firms have had major redaction breaches because they only redacted the visible layer. The underlying OCR text—SSNs, medical records, trade secrets—was still recoverable. It's a blind spot because the redaction looks perfect on screen.

How OCR-Based Redaction Works

The correct approach handles both layers:

Run OCR on the image: Extract text and its coordinates (x, y positions).
Detect sensitive content: Scan the extracted text for SSNs, phone numbers, emails, credit cards, medical IDs, dates of birth, names, addresses, and more.
Redact both layers: Cover the image pixels with black AND remove the OCR text data. Both must be handled.
Rebuild the PDF: Save with no recoverable data—text extraction won't work, pixel recovery won't work.

Critical: Both Layers Must Be Redacted

Redacting only the image leaves the OCR text intact. Redacting only the text leaves the image uncovered. You must handle both. If your tool doesn't explicitly support scanned PDFs, it's likely only redacting one layer.

DPI and Quality Considerations

Scan resolution (DPI, dots per inch) has a large effect on OCR: sharper input generally means fewer recognition errors, and each recognition error is a chance for a piece of PII to be misread and missed.

DPI	Reliability for PII Detection	Recommendation
300+	Generally reliable on clean text	A good baseline to aim for
150–200	Less reliable; recognition errors can hide PII	Re-scan higher if you can
<150	Unpredictable; OCR may fail on parts of the page	Not suitable

Aim for around 300 DPI when preparing documents for redaction. Resolution is only one factor—scan quality, font, contrast, and the language of the text all matter, and even a clean 300 DPI scan can miss something—so always review the detected results and verify the redaction before you send. Some tools can upscale low-quality scans before OCR, but it's not guaranteed to recover missing data.

Redacting Scanned PDFs with Lex Cloak

Lex Cloak automates the entire process:

Open your scanned PDF: Download Lex Cloak from the landing page, install, and open the file. The tool detects it's scanned. For what to expect, see scanned documents and OCR.
OCR runs automatically: Lex Cloak extracts text and locates it on each page (takes seconds to a minute depending on file size).
PII detection scans results: SSNs, phones, emails, credit cards, medical IDs, driver licenses, dates of birth, names, addresses, and more.
Review and adjust: Every match appears in a side panel. Uncheck false positives, or add missed items manually.
Click Redact: Both layers are redacted at once. The PDF is rebuilt and saved locally.

Local, Private, No Uploads

All processing runs on your machine. No uploads, no cloud storage, no data retention. OCR stays local, so sensitive documents remain private.

Other Approaches

Adobe Acrobat Pro (about $20/month on an annual plan, 2026): Has OCR and redaction, but no automatic PII detection. Manual redaction on a 50-page document can mean a hundred-plus clicks.

Online tools (Smallpdf, iLovePDF): Most don't support scanned PDFs. Those that do require uploading to their servers—a non-starter for sensitive documents.

Tesseract + Python: Free and powerful, but requires programming skills and setup time.

Conclusion

Scanned PDFs are the blind spot in most redaction workflows. Standard tools can't find text in images. The right approach: use a tool that detects scanned documents, runs OCR, and redacts both layers automatically. Lex Cloak does this out of the box. On a Mac, see how to redact a scanned PDF offline on a Mac, and for medical records, HIPAA PDF redaction on your desktop. For a broader comparison of redaction tools, see how to redact a PDF without Adobe.