How to redact a PDF without uploading it

What "upload" costs on this particular task

The files that get redacted are the ones that cannot be shown: a medical record, a pay stub, a lease, a witness statement, an internal memo. Uploading one to redact it means handing the unredacted version — the only version that still contains everything — to a third party, in order to be given back a version with less in it.

That third party may be entirely honest. The exposure is not mainly about honesty:

• The file exists on their disks, for as long as their retention says, and in their backups after that.
• It exists in logs and on any CDN or proxy between you and them, in forms nobody inventories.
• It is reachable by their staff, their subprocessors, and anyone who compromises any of them.
• It falls under the jurisdiction where it lands, which may not be yours — a point that matters for professional secrecy and for cross-border transfer rules.

A privacy policy is a promise about the first item. It is not a control over the rest, and none of it is something you can verify from the outside.

The browser can simply do the work

Nothing about redaction needs a server. Reading a PDF's structure, drawing its pages, painting over a region and writing the file back out are ordinary computations, and they run in a browser tab as well as they run anywhere. What a server adds to this particular task is a copy of your document on someone else's machine.

Caviardeur works that way: the file is read from disk by the page itself, processed in a background thread, and written back to your downloads folder. There is no account, no queue and no storage, because there is nowhere for a file to go.

How to tell whether a tool really is local

Claims are cheap. Two checks anyone can run, in a minute:

1. Pull the plug. Load the page, disconnect from the network — airplane mode, or unplug the cable — then do the whole job. A tool that uploads cannot work offline. One that does not, will not notice.
2. Watch the network. Open the developer tools (F12), go to the Network tab, and do the job with it open. You are looking for a request carrying your file — typically a POST whose size matches the document.

Both checks are part of this tool's own test suite, and one of them is stricter than the sentence it protects: during processing, requests to our own origin for pdf.js's standard fonts and character maps can still happen. They are fixed asset names, they carry nothing of your document — and saying so plainly is better than a promise that quietly is not quite true.

Where a local tool still needs care

Local processing protects the file in transit and at rest elsewhere. It does not make a redaction correct. A box in the wrong place, a scanned page where nothing can be detected automatically, a name that also appears in a page you never opened — these are the same problems on any tool, and they are the ones worth your attention once the upload question is off the table.