Redact a PDF, a Word file or a scan

How it works

1. Drop the document

   A PDF, a Word document (.docx), or a photo of a document (JPEG, PNG, WebP). It is read by your browser, in this tab. Suggestions appear within a few seconds.

2. Decide on each suggestion

   On the right, suggestions grouped by type; on the page, highlighted. Redact, keep, redact a name everywhere, draw an area. J and K to move from one to the next, M to redact, L to keep, Ctrl+Z to undo.

3. Produce the file

   The button becomes active when everything is decided. The tool rebuilds the document, reads it back, then offers it to you: your browser saves it.

What is detected, and how

A correct format with a wrong check digit is suggested “to review”: it is often a typo in the document, and the data is still personal. Bulk decisions never touch what is to review.

Several documents at once

Drop several files together (PDF, Word, scans, photos): they are read as a single case file. The same person, the same number are a single suggestion, decided once for all the documents, and when pseudonymising “[Person A]” refers to the same person in each one.

On export, each document is rebuilt and checked separately; if they all pass their check, they are saved together in a ZIP archive.

Your rules

Names or words to always redact (a client, a case number): add them once in “My rules”, and they are searched for and redacted in every document you open afterwards. The list stays in this browser, on this computer; it is sent nowhere.

For the numbers specific to your organisation (“FILE-2026-0114”), “Search by pattern” takes a regular expression: each text found becomes a suggestion to decide, like the others.

The mapping table

When pseudonymising, the tool offers to save the table of labels and what they replace (“[Person A] = John Smith”), so that you can re-identify later. It is encrypted in your browser (AES-GCM, key derived from your passphrase by PBKDF2, 600,000 iterations), then saved as a file to keep separately from the document. To read it again: “Open a mapping table”, below the drop area.

An open table serves twice more. “Reuse this table”: the documents you open next get the same labels (John Smith becomes “[Person A]” again in each new document), new people take the next labels, and the table saved at the end extends the old one. “Restore the names”: a PDF or Word file pseudonymised by Klarmask that came back annotated or completed gets the names back in place of the labels, in your browser.

Klarmask knows neither the table nor the passphrase: a forgotten passphrase cannot be recovered. And as long as the table exists, the pseudonymised document is still personal data; see pseudonymisation or anonymisation.

The redaction report

With the file produced, the tool offers a PDF report: the date, the mode, each document with its number of pages and the SHA-256 fingerprint of the file produced, what was redacted by type and by page, the areas covered on the image, and the result of the output check. No redacted value appears in it, and no label: it can accompany the document, to keep a record of the redaction or to attach it to a disclosure.

Before saving, a summary says how many distinct items will be redacted and in how many occurrences, what is left visible, and the kinds of data this document contains none of. Over a hundred pages, that is what shows something is missing: a personnel file without a single social security number often has a page that was read badly.

Scans and photos

A page with no text (a scan, a photo of a document) is read by text recognition, in your browser. The engine is the one used by Klarfile (Tesseract): it is downloaded from this site the first time it is needed, with the model for the site's language, and each file is verified by its fingerprint before use.

Each word read keeps its place on the image: suggestions are decided as on a PDF, and the black box covers the whole word. A phone photo is turned the right way up, and its metadata (device, location) does not pass into the file produced.

During the check, the scanned pages of the file produced are read back by text recognition, and each redacted item is searched for: a badly placed black box would leave a value readable, and saving would be blocked. The file produced also contains searchable text, without what is redacted.

Signatures, stamps, faces, number plates and codes

A page also carries what is not text: a signature, a stamp, the photo on an identity document, a QR code containing a file number. Once the document is open, each page is read again as an image, in your browser, and what is found outside the text is suggested as an area, to redact or keep like a name. Until this reading is finished, and until every suggested area is decided, the file cannot be produced.

Signatures and stamps are found by their ink: a thin stroke, blue or black, or a coloured ink, outside the words already read. Faces seen from the front are found by pico (MIT licence), and the area extends to the whole photo. QR codes and barcodes are read by zxing (MIT licence), served from this site and checked against its fingerprint. A face in profile, a very faint signature or a damaged code can be missed: check the page, and draw an area over what is not suggested.

Number plates in photographs are found by the regularity of their characters: a plain light background, dark thick characters in a row. In a written document a plate number is text, and a rule finds it. A plate covering less than a tenth of the width of the photograph, strongly tilted or dirty, is not proposed.

Several versions of the same document

A document is not redacted the same way for the other party, for the public and for internal use. In “Several versions”, add a version, name it, and tick the types it leaves visible; everything else follows your review. The versions come out together, each in its folder of the archive, with its own redaction report.

Labels do not change from one version to another: “[Person A]” is the same person everywhere, and a single correspondence table covers them all.

Continue later, and keep the trace

A hundred pages are not decided in one sitting. “Continue this review later” saves the work in progress (decisions, areas, versions, mode) in a file encrypted with a passphrase. Reopen the same documents, read that file back, and the review resumes where you left it. The documents are not in the file; the detected values are, which is why it is encrypted.

The redaction register, under the drop area, keeps one line per file produced on this computer: the date, the documents, the pages, the mode and the SHA-256 fingerprint of what came out. No redacted value, no label. It stays in this browser, exports as CSV and is cleared with one button.

Documents that come back

A letterhead, a footer, a number printed in the margin: the same area comes back on every page. Draw it once, then “Repeat” on all pages, the even ones or the odd ones. A page of another size gets it in the same relative place.

A kind of document that comes back (a payslip, a statement) is redacted in the same places every time: save its areas and your rules under a name, in “Templates”, and replay them on the next one. Templates stay in this browser, on this computer.

A file carries them: “Save the file” writes your templates and your rules, “Read a file” puts them back, here or on a colleague's machine. What it brings is added to what you have, nothing is overwritten. The file is not encrypted, and your rules are names: keep it as a document.

Word documents

A Word document is an archive of files: the text, but also tracked changes, comments, properties (author, company), fields and links. A name hidden in one of these parts survives a find and replace.

Klarmask does not clean the document: it writes a new one, with only the parts it understands. Tracked changes are accepted (deleted text disappears along with its author), comments and properties are removed, and each redacted value is replaced wherever it appears: in the text, even when split across several formatting runs, in headers, footers, notes, text boxes, fields, image alt text and link addresses.

The file produced is read back as for a PDF: every paragraph, every attribute and every image is walked through, and the structure of the package is checked before it is offered to you.