Guide · 6 min read

How to redact a bank statement safely (without uploading it)

Landlords, lenders, visa applications and expense teams all ask for bank statements. Usually they need to see one or two things, and you'd rather not hand over the rest. Here's how to black out the sensitive parts properly, and keep the file off other people's servers while you do it.

A bank statement is one of the most sensitive documents most people share regularly. It ties together your name, address, account number, sort code, balance and a month of who-you-pay-and-when. When a letting agent asks for "proof of income" or an expense system wants "evidence of the transaction", they almost never need all of that. Redacting the rest is sensible, and worth doing carefully.

Decide what actually needs to be visible

Start from what the other party legitimately needs, and hide everything else. Common cases:

Proof of income: they need your name, the salary credits and maybe the running balance. You can usually hide the account number, sort code, and unrelated transactions.
Proof of address: they need your name and address and the bank's letterhead. Almost everything financial can go.
Expense claim: they need the single matching transaction. The account number, balance and every other line can be blacked out.

The usual things to remove: account number, sort code or routing number, IBAN, any card numbers, the balance (if not needed), and unrelated transactions. If a field isn't doing a job for the recipient, cover it.

Two mistakes that undo the whole thing

Covering the text instead of removing it

Statements are usually PDFs, and a black box drawn over a PDF often leaves the number selectable and copyable underneath. That's the same trap that catches people redacting any PDF: the mark is on top, the data is still there. We go into this in detail in how to redact a PDF properly, but the short version is that redaction has to remove the content, and you should verify it did by trying to copy-paste the blacked-out area.

Missing the repeats

Your account number doesn't appear once. It's typically in the header of every page, in the account summary, and sometimes inside transaction references. Redact page one, miss the footer on page three, and you've leaked it. Whatever tool you use, check every page, and watch for the same number in more than one format.

The upload trap

Search "redact bank statement online" and most results are sites that ask you to upload the PDF to their server, where it's processed and, in many cases, retained for some period. For a document that maps your entire financial life, uploading it to a stranger's server to hide a few digits is the wrong trade. The safest tools do the redaction on your own device and never transmit the file at all.

This matters more here than almost anywhere. Even if a site is reputable, you've now created another copy of your full statement somewhere you don't control. Keep it local.

A safe workflow

Work from a copy on your device, offline if you like. Don't upload the original anywhere.
Use a tool that removes the content and outputs a flat file. For a PDF, that means the sensitive text is gone from the file, not covered. For a screenshot or photo of a statement, that means a flattened image (see how to black out text on a screenshot).
Redact every page. Account number in each header, the summary block, and any transaction references.
Verify. Try to select and copy the blacked-out numbers. If anything copies, it wasn't removed. Check the filename too, "statement-acct-8842.pdf" leaks before it's opened.

Doing it with Private Redaction

Private Redaction is built for exactly this: the file stays on your device, and the output has the sensitive content genuinely removed.

Upload the PDF to the web app and auto-detect will flag account and card numbers, sort codes, IBANs, names and addresses for you. Tick or untick each item, black out anything else by hand, and download a PDF with the content removed.
If your statement is a screenshot or photo, the browser extension redacts images the same way, on-device, and exports a flat image.
Detection is a head start, not a guarantee. Always review every page before you send; you know which lines matter.

If you handle other people's statements at scale, for lending, compliance or property, the same principles apply, plus the confidentiality duties covered in what "redacted" has to mean under GDPR and HIPAA.

Private Redaction blacks out account numbers, balances and transactions and gives you back a file with them genuinely removed, all on your device, nothing uploaded. Free to use for PDFs and documents, or as a Chrome extension for screenshots and images.

Takeaways

Hide everything the recipient doesn't need: account number, sort code, IBAN, card numbers, balance, unrelated transactions.
Cover isn't enough; the content has to be removed. Copy-paste the blacked-out area to check.
Your account number repeats across pages and sections; redact all of them.
Don't upload your statement to redact it. Use a tool that works on your device.