This is a small, single-purpose set of PDF tools: redact a document, flatten its form fields, or strip its metadata. All three run inside your browser. There is no server doing the work, no account to create, and no limit on how many files you put through it.
It exists because the obvious way to solve this problem is to upload a sensitive document to somebody else, and that is a strange thing to have to do when the machine in front of you is perfectly capable of the job.
How it is built
The site is a static one. Pages are generated ahead of time with Astro and served as plain files from Cloudflare, which means there is no application server anywhere in the picture and no database. That is not a performance decision. A backend that never existed cannot be breached, subpoenaed, or misconfigured into leaving a bucket of documents open to the internet.
The document work is JavaScript running in the page rather than a WebAssembly engine. Two libraries do the heavy lifting: pdf.js renders pages to a canvas and pulls text out of them, and pdf-lib assembles the file you download. Both run in the tab, on your machine, on a document that never travels. To be exact about it, since an earlier version of this site claimed WebAssembly and was wrong: the page logic is JavaScript, and the only WebAssembly here is the handful of image decoders pdf.js uses for scanner formats like JBIG2 and JPEG 2000. Those are served from this site and fetched only when a document actually needs one.
What the redaction engine actually does
Worth spelling out, because the difference between doing this correctly and appearing to do it correctly is invisible in the result.
When you export, the document is first loaded and its form fields flattened, and the metadata fields cleared. Each page carrying at least one mark is then rendered to an offscreen canvas at high resolution, your marked rectangles are filled opaque black on that canvas, and the canvas becomes an image.
Then the important part. Rather than swapping the new image into the existing document, a completely fresh PDF is created. Pages you never marked are copied into it. For each page you did mark, a blank page is added carrying only the flattened image. Nothing belonging to a marked page is copied across at any point, so nothing from it can survive into the file you download.
An earlier version did it the other way, detaching the marked page in place and inserting a replacement. That leaves the original page's content sitting in the file unreferenced and fully readable, which is a failure that looks like a success from every angle except an inspection of the bytes. The how to properly redact a PDF page documents what went wrong, how it was found, and how to check any redacted file yourself.
What it costs
Rebuilding a page as an image is what removes the text, and it is not free. A page you mark loses its text layer completely, so every word on it — not only the words you covered — stops being selectable, searchable and copyable, and assistive software can no longer read any of it. The file also gets larger. Pages you leave unmarked are copied over untouched and keep their text exactly as it was, so the cost is paid per page rather than per document.
The rebuild also drops document outlines, the tagged structure tree and named destinations, because those do not survive being copied between documents. That is a genuine loss and it is accepted deliberately: an outline entry pointing at a removed page is one of the things that kept unredacted content alive in the older version.
What it cannot do
Password-protected documents are refused rather than partially handled. XFA forms, the kind older enterprise tooling produces, cannot be flattened by the library underneath this, and the tool says so when it meets one. Digital signatures do not survive any export, because rewriting the file is what breaks them; the original on your device is untouched.
Metadata inside an embedded image is not cleared. A photograph placed into a PDF keeps its own EXIF block, which can carry a camera model and sometimes GPS coordinates, and that belongs to the picture rather than to the document. There is no search-and-redact across a whole document either: you mark what you can see. And because rasterizing happens in the tab, a very large file will make the page sit still while it works, and on a phone can exhaust the tab entirely.
Who makes it
One person, independently. This is not a company, there is no team page because there is no team, and there is no office address to publish. Running costs are low precisely because there is no backend, and the site is paid for by advertising, which is set out in the privacy policy.
Corrections are welcome, particularly on the technical pages. If something here is wrong, say so and it will be fixed.