Hidden Text in a PDF: How to Find It Before You Share

To find hidden text in a PDF, select all the text on each page, paste it into a plain text editor and compare it with the page. Then check the layers panel, comments, attachments and document properties. Text that appears in the paste but not on the page is hidden; a box drawn over text does not remove it.

A PDF page is a set of drawing instructions. Text, shapes and images are painted in order, so something painted later can cover something painted earlier without deleting it. That is why a document can look clean on screen and still carry names, figures or earlier wording that anyone can copy out. This guide covers the six places text usually hides and a check you can run before a file leaves your organisation.

Why hidden text matters before you share

The US National Security Agency's guide Redacting with Confidence (report I333-015R-2005) names covering text with black as the most common redaction mistake, and states that information hidden or covered in a computer document can almost always be recovered. Its advice is that sensitive information must be deleted, not just made invisible.

In regulated work this comes up often: a batch record extract sent to a customer, a deviation report shared with a contract manufacturer, an SOP handed to an auditor, or a study document that once listed patient or employee names. If personal data could be involved, check your organisation's procedure with your DPO or QA team before release.

The six places text hides in a PDF

1. Under a box, a shape or an image

A black rectangle, a white box or a pasted image can sit on top of text. The text is still there and can be selected, searched and copied. The NSA guide gives the same warning for images: covering part of an image with another graphic does not remove what is underneath.

2. White, tiny or invisible text

Text can be coloured white on a white page, set at a very small size, or drawn in the invisible text rendering mode. ISO 32000-1:2008, section 9.3.6, defines text rendering mode 3 as "neither fill nor stroke text (invisible)". Invisible text is not always a problem: OCR software places an invisible text layer over a scanned image so the page can be searched. Our own OCR PDF tool does this, drawing the recognised words with zero opacity. The check is whether that layer says what the image shows, and nothing more.

3. Outside the visible page

Each page has a crop box. ISO 32000-1, section 14.11.2, says the crop box defines the region to which the page contents are clipped when displayed or printed. Content outside it is not shown, but it is still in the file. Cropping a page usually just changes this box, as our guide on how to crop a PDF explains, so a cropped-off margin note can survive.

4. Hidden layers (optional content)

Since PDF 1.5, a file can contain optional content groups, usually called layers. Section 8.11.2 of ISO 32000-1 describes them as collections of graphics that can be made visible or invisible by the user. CAD drawings, artwork and multi-language documents use them, and a layer that is switched off can still hold text.

The PDF Layer Manager lists the layers in a file, with each layer's name and whether it is on by default. In the current version, listing and adding layers are the only actions that work: the show, hide, rename and delete buttons save the file unchanged. To look at the content of a hidden layer, switch it on in a full PDF reader's layers panel.

5. Comments, form fields and attachments

Comments and sticky notes are annotations, stored separately from the page content and often collapsed. Form fields are defined by their own field dictionaries (section 12.7.1) and hold values separately from the drawn page. A PDF can also carry whole files: ISO 32000-1, section 7.11.4, describes embedded file streams, and section 12.5.6.15 describes file attachment annotations placed on a page. The Extract Attachments tool lists and saves both kinds, document-level attachments and those attached to a page.

6. Metadata and earlier versions

Section 14.3.1 of ISO 32000-1 describes two places for metadata: the document information dictionary and XMP metadata streams. Both can hold an author name, a title or a working file name. View Metadata shows the document information dictionary, page count and PDF version; it does not read XMP.

A PDF can also be saved by incremental update. Section 7.5.6 says changes are then appended to the end of the file, leaving its original contents intact. Text that was deleted in a later edit can therefore still be present in the bytes of the file.

A step-by-step check before you send

1. Select all and paste. In your PDF reader, select all text (Ctrl+A or Cmd+A), copy and paste it into a plain text editor such as Notepad or TextEdit. Read the pasted text against the page. Words that you cannot see on the page are hidden.
2. Search for what should be gone. Use the reader's search for names, initials, batch numbers, patient or subject IDs, prices and email addresses. A hit inside a black box means the redaction failed.
3. Open the layers panel. Turn every layer on and look again. Use the Layer Manager to get a quick list of layer names.
4. Open the comments panel and the form. Expand all comments and replies. Click through form fields, including any that look blank.
5. List attachments. Run Extract Attachments, or open the attachments panel in your reader. Each attachment needs its own review.
6. Check the properties. Look at title, author, subject, keywords and custom properties. Remember that XMP is a second copy that a properties dialog may not show.
7. Look for earlier revisions. Open the PDF in a text editor and search for %%EOF. ISO 32000-1 says each incremental update ends with its own end-of-file marker, so more than one suggests appended changes. A linearised (fast web view) file can also have an extra marker after its first-page trailer (Annex F.3.4), so treat this as a prompt to look further, not as proof.
8. Search the raw file if the stakes are high. Most PDFs compress their content, so a text editor shows little. The free, open-source qpdf tool has a --qdf mode that, in its documentation's words, creates a PDF file suitable for viewing and editing in a text editor, with streams uncompressed. Run qpdf --qdf --object-streams=disable in.pdf check.pdf and search check.pdf for your terms. Text in some fonts is stored as codes rather than letters, so a miss here is not a guarantee.

How to remove what you find

• Go back to the source. The most reliable fix is to delete the content in the original Word or Excel file and make a new PDF. This matches the NSA guide's rule that information must be removed through deletion.
• Redact properly. A real redaction removes the text and image data under the mark. Our guide on how to redact a PDF properly covers the method and how to test it.
• Clear the hidden extras. Sanitize PDF removes JavaScript, attachments, links and metadata (including XMP) and flattens form fields. It does not look at text on the page, layers or text under boxes, so it complements redaction rather than replacing it.
• Flatten to images as a last resort. Rasterize PDF, with PDF chosen as the output format, renders each page to an image and builds a new file from those images. The text layer, attachments and original document properties do not carry over. The cost is real: the text is no longer searchable, selectable or readable by screen readers, and many submission rules expect searchable text.

What these checks cannot catch

Copy and paste finds text, not pictures of text. A screenshot of a spreadsheet pasted into a report is an image, so names inside it will not appear in the pasted text or in search; you have to look at it, or run OCR first. Pasted text can also come out in an odd order, so a hidden word may land far from where it sits on the page. If a file has permission settings that stop copying, you need to remove them, with the owner's agreement, before you can check it properly.

For anything sensitive, have a second person repeat the check on the final file, the exact copy you will send, not an earlier draft. If the document contains personal data, follow your data protection procedure and record what was checked. This is general information, not legal advice.