https://redenta.app

Redenta is a set of document tools that run entirely in the browser — redaction, metadata stripping, and format conversion. Nothing is uploaded, there's no account, and the tools are free.

The redaction is the part I actually care about.

Most tools that "redact" a PDF draw a black rectangle over the text. The text is still in the file. Copy-paste it, or open the file in a byte inspector, and it's right there. This has repeatedly burned courts, police forces and newspapers, and it keeps happening because the output looks correct.

Redenta renders each page to a canvas, paints the redaction boxes into the pixels, and rebuilds the PDF as image-only. There is no text layer left to recover. As a backstop, the output is inspected before it's handed to you and the export is refused if any font object survived the rebuild — if the guard trips you get an error instead of a file that looks fine.

You don't have to take my word for it. Redact something, download it, and search the result — in a viewer, with pdftotext, or by inflating the streams and grepping. One gotcha if you try the byte-level route: pdf-lib writes show-text operands as hex, so a naive latin1 search finds nothing even in an un-redacted PDF. Decode the hex or the test is vacuous. That caught me out while writing the tests.

It also works with the network off. That's the one claim that's trivial to check, so check it.

What it does not do, plainly. Auto-detection finds structured data — account numbers, cards, emails, IBANs, sort codes, postcodes, SSNs, IP addresses, API keys — plus names that carry a title or label ("Mr ...", "Account Name: ..."). It does not find unlabelled names in free text, and it does not find street addresses. You add those yourself by typing a word or drawing a box. The UI says so and asks you to review every page, because a redaction tool that quietly misses things is worse than no tool.

The output is a flattened image, so the redacted PDF is no longer text-searchable. That's the trade-off for the content actually being gone, and it's the right way round for this job.

One bug worth describing, because it nearly shipped. I originally supported redacting Word/Excel/Markdown by rendering them to HTML and rasterising with html2canvas. html2canvas paints text a few pixels lower than the DOM lays it out, so boxes derived from DOM ranges sat slightly high and the bottom sliver of every redacted glyph survived in the output — enough to read digits. The PDF path is immune because pdf.js supplies both the raster and the text positions, so the two agree by construction. Those formats are disabled until the box geometry comes from the same renderer that draws the text. The general lesson: if your mask geometry and your pixels come from two different renderers, you have a leak and it will look fine.

Stack is TypeScript, Next.js, pdf-lib and pdfjs-dist. The conversion engine is a pure, framework-free package with no DOM access; the browser-only parts are adapters at the edge. Tesseract and its language data are vendored rather than fetched, so the CSP allows no external connections at all.

I'd particularly like people to try to break the redaction and tell me if anything survives. That's the whole product.