How to properly anonymize a Word, PDF or Excel document (metadata leaks included)
4 min read
Properly anonymizing a document means removing the personal data from the actual content and from everything around it — the file’s metadata, author name, tracked changes, comments, and hidden rows or columns — not just drawing black boxes over visible text. A “redaction” that only hides text on screen is the most common way sensitive data leaks: the original is still in the file, recoverable by copy-paste, “undo”, or reading the metadata. Real redaction deletes the data and preserves the document’s formatting.
TL;DR
- Black boxes ≠ redaction. If the text is still underneath, it can be copied out or recovered.
- Metadata leaks identities: author, company, last-modified-by, and file properties travel with the file.
- Hidden data leaks too: tracked changes, comments, speaker notes, hidden Excel columns, filtered rows.
- PDFs made by “printing” a redacted Word file can still carry text under the boxes — flatten and strip.
- The goal is to remove the data while keeping the layout so the document is still usable.
Why “black box” redaction fails
The classic mistake: draw a filled rectangle over a name in Word or a PDF viewer and save. On screen it looks redacted. In the file, the text is untouched — anyone can select underneath it, copy it, remove the shape, or extract it from the PDF’s text layer. Numerous real-world leaks have happened exactly this way.
Real redaction deletes the underlying characters and replaces them with a placeholder or nothing — so there is no original left to recover.
Fake redaction: "████████ owes 12,400 PLN" ← "Jan Kowalski" still in the file
Real redaction: "[PERSON] owes 12,400 PLN" ← the name is goneThe leaks people miss: metadata and hidden data
Even with the visible text handled, documents carry personal data in places you don’t see:
| Where it hides | Format | What leaks |
|---|---|---|
| Document properties | Word, Excel, PDF | Author, company, last-modified-by |
| Tracked changes | Word | Deleted names, edit history |
| Comments / notes | Word, PDF, Slides | Reviewer identities, side remarks |
| Hidden columns / rows | Excel | Filtered-out PII you thought was gone |
| Headers / footers | Word, PDF | Names and IDs repeated on every page |
| Embedded thumbnails | Office | A preview image of the un-redacted page |
A thorough anonymization pass has to reach all of these, not just the body text.
Format by format
Word (.docx): Accept or reject all tracked changes, delete comments, clear document properties (File → Info → Inspect Document), and check headers/footers. Then mask the names and IDs in the body.
Excel (.xlsx): Unhide every column and row before redacting — hidden and filtered data is still in the file. Watch for PII in formulas, named ranges, and secondary sheets. Remove document properties.
PDF: Use true redaction that removes the text layer, not annotation boxes. If the PDF was exported from Word, confirm no recoverable text sits under the marks, and strip metadata. Flatten the file so nothing is a movable object.
Keep the formatting
The point of masking a document (rather than retyping it) is to keep it usable — the table still lines up, the contract still reads correctly, the letterhead survives. Good anonymization replaces Jan Kowalski with [PERSON] in place, preserving layout, so you get a clean, shareable version without rebuilding it.
Do it locally
Uploading a sensitive contract to an online “PDF redactor” sends the very data you’re protecting to someone else’s server. Masking documents on your own machine keeps the original off third-party infrastructure — the on-device approach that avoids adding a new place your data can leak.
FAQ
Is drawing a black rectangle in a PDF viewer safe? No. Unless the tool actually removes the underlying text, the content is still in the file and recoverable.
Does saving as PDF remove Word metadata? Not necessarily — author and properties often carry over, and text can remain under redaction marks. Inspect and strip explicitly.
What about hidden Excel columns? Hidden and filtered data is fully present in the file. Unhide everything, redact, then re-check before sharing.
Can I keep the document’s formatting after redaction? Yes — proper in-place masking replaces identifiers with placeholders while preserving layout, so the file stays usable.
Where should I redact documents? Locally, so the sensitive original never leaves your machine. Online redactors upload the exact file you’re trying to protect.
Amaze masks names (including Polish inflected forms), PESEL, NIP, REGON, KRS, emails, phones and IBANs inside your Word, PDF and Excel files — preserving formatting and catching the details manual redaction misses — entirely on your own machine. See how it works.
Part of our guide: how to use AI without leaking client data.