Skip to main content
Orilami

Auto-Redaction

Load a PDF and sensitive numbers are found automatically; load an image and box them by hand. Everything runs in your browser, and matched pixels are destroyed — not covered.

Auto-Redaction — Destroy Sensitive Data In-Browser

A privacy-first redaction engine that finds and permanently destroys sensitive entities — card numbers, IBANs, SSNs, EINs, emails and more — in PDFs and images, entirely in your browser. Nothing is uploaded, no server is contacted and no telemetry is sent. Crucially, it does not hide data behind a black box: it overwrites the raw pixels, so there is nothing left to peel back.

How redaction actually works here

  • Detection (PDF): the text layer is extracted with pdf.js, and deterministic detectors run over it — card numbers are Luhn-validated, IBANs pass an ISO 7064 mod-97 check, IPv4 octets are range-checked — so a random 16-digit string is not mistaken for a card. Each hit is mapped back to its exact glyph rectangle.
  • Destruction: matched regions are painted directly into the raster pixel buffer with solid black (0x000000FF) or cryptographic noise from crypto.getRandomValues(). The original RGB values are gone.
  • Rebuild (PDF): each page is flattened to an image and re-assembled into a fresh PDF with no content stream, no fonts and no text layer — so a “black rectangle over selectable text” leak is structurally impossible. The trade-off is an image-only, non-searchable output.
  • Metadata: exporting through a clean canvas / new document drops the source EXIF, XMP, GPS and PDF Info; none of it rides along.
  • Proof: after export, the tool measures the entropy and uniformity of every redacted region and re-extracts text from the output to confirm zero residual items.

On honesty and limits

There is no bundled OCR or vision model. Automatic detection needs a text layer, so it applies to PDFs, not to photographs or scanned images — for those you draw the boxes yourself and the destruction and metadata-stripping steps are identical. Deterministic detectors catch well-formed, checksummed identifiers; they will miss data written in prose, unusual national-ID formats, or anything embedded in an image. Always review the highlighted regions before exporting: this tool makes redaction irreversible and easy to verify, but you remain the judge of what is sensitive.

FAQ

Is my file uploaded anywhere?
No. Parsing, detection, pixel destruction and export all run in your browser. The file never leaves your device and no server, model host or analytics endpoint is contacted.
Can the black boxes be removed to reveal the data?
No. Unlike a floating rectangle or an annotation, the matched pixels are overwritten in the raster buffer and the PDF is rebuilt as flattened images with no text layer. There is no hidden layer beneath the box to recover — the verification panel re-extracts text from the output to prove zero residual items.
Why is the redacted PDF no longer selectable / searchable?
That is the security guarantee: to make redaction truly irreversible we flatten every page to an image and discard the original text and fonts. If the text could still be selected, it could still be leaked. Use a higher DPI for a crisper image-only result.
Does it auto-detect data inside a photo or a scan?
No — that would need OCR or a vision model, and none is bundled (we don't ship models we can't run reliably offline). For images, draw a box over each sensitive area; the destruction and metadata-stripping are exactly the same as for PDFs.
What is the difference between solid black and noise fill?
Both destroy the underlying pixels. Solid black yields a uniform region (zero variance); cryptographic noise fills it with high-entropy random bytes. Noise makes it visually obvious the area was intentionally destroyed and defeats any assumption about the original content's shape.
Which identifiers are detected?
Luhn-validated card numbers (PANs), mod-97 IBANs, US SSNs and EINs, emails, phone numbers, IPv4 addresses and passport MRZ lines. Card, IBAN and email detection are on by default; enable the others as needed.