Black out names, SSNs, dates, and record numbers in a medical PDF — nothing left to copy or extract, and the file never leaves your device.
Black out names, SSNs, dates, and record numbers in a medical PDF — nothing left to copy or extract, and the file never leaves your device.
Redact protected health information (PHI) from a PDF — lab results, referral letters, claims, records requests — before you share it. GhostPDF's redaction is destructive: every page is flattened to an image with your boxes burned in, so there is no text layer left for anyone to copy, search, or extract — and the output is re-checked to confirm that. It all runs in your browser, so the unredacted record is never uploaded to a third-party service — the step that makes most online redaction tools a problem for health data in the first place.
Auto-detect reads the text layer (or OCRs scanned pages in your browser) and finds structured identifiers — Social Security numbers, phone numbers, email addresses, dates, IP addresses, and card and bank numbers — and an on-device language model (loaded on capable devices) flags person names. Add your own custom rules for medical record numbers, member IDs, or a clinic's naming patterns. Then review every box, draw any extra ones by hand, and apply.
Drop the record
It opens in the GhostPDF studio with Redact pre-selected. Nothing is uploaded.
Detect and review
Run auto-detect for SSNs, dates, phone numbers, emails, and (on capable devices) names. Add custom rules for record or member numbers. Check every suggestion and draw boxes over anything it missed — logos, signatures, photos.
Apply and verify
Every page is flattened with the boxes burned in, then re-checked for any recoverable text. Download the redacted PDF — or X-ray it for a second pass over metadata and hidden data.
The Safe Harbor list is longer than you think
HIPAA's Safe Harbor de-identification method lists 18 identifier types — including dates more specific than the year, ZIP codes, device identifiers, and full-face photos. Automatic detection covers some; the rest need review.
Check the metadata too
A PDF's author, title, and editing-software fields can name the patient or clinician even when the page is clean. Remove metadata after redacting, or run the X-ray over the finished file.
Share it safely
Once redacted, send it with a one-time GhostSend link, or password-protect the PDF.
Does this make me HIPAA compliant?
No tool does that on its own. HIPAA compliance depends on your policies, agreements, and review process. What GhostPDF removes is one risk: the unredacted record never goes to a third-party server, so no vendor handles it. You remain responsible for reviewing what's removed.
Will it find everything?
No automatic detector does. It reliably finds structured identifiers (SSNs, phone numbers, emails, dates, card and IBAN numbers) and, with the on-device model, most person names. Addresses, rare identifiers, and handwriting need a human pass — review every page before sharing.
Is a black box enough?
A drawn rectangle in most PDF editors only covers text; copy-paste still reveals it. GhostPDF flattens each page to an image with the boxes burned in, so nothing underneath survives — the trade-off is that the output text is no longer selectable.
What about scanned records?
Auto-detect OCRs scanned pages in your browser, so it can find identifiers in scans too — accuracy depends on scan quality, and handwriting usually isn't read. Draw boxes by hand over anything it misses.
Is anything uploaded?
No. Detection, redaction, and verification all run in your browser. The OCR engine and the name-detection model are downloaded to your device; your document is not sent anywhere.
A reproducible test of six free redaction tools: what each one actually removed, and what it left in the file.
The 18 Safe Harbor identifiers, de-identification versus redaction, and a document checklist.
Why a black rectangle over PDF text usually hides nothing, and what real redaction removes.
Redact PDF
Black out sensitive text so it is removed, not just covered.
Remove metadata
Strip author, dates, and hidden properties before a PDF leaves you.
Redact a bank statement
Black out account numbers and transactions before you send a statement.
Password-protect PDF
Encrypt a PDF so it needs your password to open — encrypted locally.
Every GhostPDF tool runs entirely in your browser. Your file is never uploaded — there's no upload endpoint to send it to.