How to Redact Scanned PDFs (OCR Redaction Guide)

Scanned PDFs are fundamentally different from digital PDFs, and most redaction tools fail to handle them. When you scan a paper document, the result is an image with no underlying text data. Standard redaction tools have nothing to work with. But there's a deeper problem: many scanners automatically add an invisible OCR text layer on top of the image. You redact the visible pixels, but the sensitive data remains in the hidden text layer.

Why Scanned PDFs Are Different

PDFs are structured in layers. A digital PDF from Word or Google Docs contains a text layer (searchable data) and a rendering layer (how it looks). A scanned PDF is just an image—pixels only. No text layer. No searchable content. Some scanned PDFs are hybrid: an image with an invisible OCR text layer added on top.

The Hidden OCR Layer Problem

This is where redaction failures happen. You open a scanned PDF, draw a black box over a social security number, and it looks gone. But if the PDF has an OCR layer, the actual SSN data is still there underneath the pixels. Someone with the right tool can extract it.

This isn't theoretical. Government agencies and law firms have had major redaction breaches because they only redacted the visible layer. The underlying OCR text—SSNs, medical records, trade secrets—was still recoverable. It's a blind spot because the redaction looks perfect on screen.

How OCR-Based Redaction Works

The correct approach handles both layers:

1. Run OCR on the image: Extract text and its coordinates (x, y positions).
2. Detect sensitive content: Scan the extracted text for SSNs, phone numbers, emails, credit cards, medical IDs, dates of birth, names, addresses, and more.
3. Redact both layers: Cover the image pixels with black AND remove the OCR text data. Both must be handled.
4. Rebuild the PDF: Save with no recoverable data—text extraction won't work, pixel recovery won't work.

DPI and Quality Considerations

OCR accuracy depends on DPI (dots per inch). Higher DPI = sharper text = better OCR.

Scan at 300 DPI minimum if you're preparing documents for redaction. Some tools can upscale low-quality scans before OCR, but it's not guaranteed to recover missing data.

Redacting Scanned PDFs with Lex Cloak

Lex Cloak automates the entire process:

1. Open your scanned PDF: Download Lex Cloak from the landing page, install, and open the file. The tool detects it's scanned. For what to expect, see scanned documents and OCR.
2. OCR runs automatically: Lex Cloak extracts text and locates it on each page (takes seconds to a minute depending on file size).
3. PII detection scans results: SSNs, phones, emails, credit cards, medical IDs, driver licenses, dates of birth, names, addresses, and more.
4. Review and adjust: Every match appears in a side panel. Uncheck false positives, or add missed items manually.
5. Click Redact: Both layers are redacted at once. The PDF is rebuilt and saved locally.

Other Approaches

Adobe Acrobat Pro ($20/month): Has OCR and redaction, but no automatic PII detection. Manual redaction on a 50-page document means 100+ clicks.

Online tools (Smallpdf, iLovePDF): Most don't support scanned PDFs. Those that do require uploading to their servers—a non-starter for sensitive documents.

Tesseract + Python: Free and powerful, but requires programming skills and setup time.

Conclusion

Scanned PDFs are the blind spot in most redaction workflows. Standard tools can't find text in images. The right approach: use a tool that detects scanned documents, runs OCR, and redacts both layers automatically. Lex Cloak does this out of the box. On a Mac, see how to redact a scanned PDF offline on a Mac, and for medical records, HIPAA PDF redaction on your desktop. For a broader comparison of redaction tools, see how to redact a PDF without Adobe.