Guide · 6 min read

How to redact a Word document (properly)

A Word file leaks more than a PDF. Blacking out text is the least of it — the bigger risks are tracked changes, comments, metadata and hidden text you never see. Here's how to actually clean a .docx and check nothing's left behind.

PDFs get the headlines, but Word documents are the sneakier leak. A .docx isn't a flat page — it's an editable file with layers of history baked in. Delete a sentence and it can live on in tracked changes. "Black out" a name and the text underneath is still selectable. And the document quietly carries who wrote it, which organisation they work for, and sometimes earlier drafts.

What's actually hiding in a .docx

• Tracked changes. If change-tracking was ever on, every deletion is still stored. "Deleting" sensitive text just marks it deleted — a recipient can show markup and read it.
• Comments. Reviewer notes, often more candid than the document itself.
• Document metadata. Author name, company, manager, template, total editing time, and revision history sit in the file properties.
• Hidden text. Word has a "hidden" formatting flag; text can be present but not shown.
• Embedded content and earlier versions. Linked objects, and in some workflows, autosaved or fast-saved remnants.

The methods that don't work

• Highlighting the text black, or dropping a black shape over it. Cosmetic only — the text is untouched and still copy-pasteable.
• Deleting the text and saving. Safe only if tracked changes was never on and you've cleared the metadata. Otherwise the "removed" text is recoverable.
• "Mark as Final." Does nothing to the content; it's a soft nudge, not protection.
• Password-protecting the file. Controls access, doesn't remove anything.

How to actually redact a Word document

1. Resolve the history. Accept or reject all tracked changes (so nothing's stored as "deleted"), and delete every comment.
2. Strip the metadata and hidden content. In Word: File → Info → Check for Issues → Inspect Document. The Document Inspector finds and removes properties, hidden text, comments and revision remnants. Run it and remove what you don't want to ship.
3. Remove the sensitive text — and get it out of the editable format. This is the step people skip. Even after deleting text in a live .docx, editable files are the wrong format to trust for redaction. The reliable move is to remove the content and flatten the result: export a version where the sensitive text simply isn't in the file, and there's no editable layer to recover it from.
4. Verify. Open the output and try to copy the redacted areas. If anything selects, you're not done.

The shortcut: extract, redact, flatten

Because the editable format is the problem, the cleanest approach is to take the text out, redact it, and produce a flattened file with the sensitive content genuinely gone. Private Redaction does exactly that with a .docx: it reads the text, blacks out what you choose, and gives you back a PDF with the sensitive content removed — not just covered, and with no recoverable layer. It's a clean, redacted document rather than a pixel-perfect copy of your Word formatting, which is the right trade for something you're about to share.

Two things worth knowing: the whole thing runs in your browser (the file never leaves your device), and the step that needs AI — finding names, addresses and the like — runs inside a sealed, hardware-verified enclave, so that text isn't exposed to anyone in the process. One honest caveat: automated detection can miss things, so the copy-paste check on the output still matters.

Don't forget the original

Redacting a copy you share is only half the job. The original Word file still holds the metadata and history. If you're sending the Word file itself for any reason, inspect and clean it first — and where you can, send a flattened PDF instead of the live document.

Takeaways

• A Word file carries tracked changes, comments, metadata and hidden text — far more than what's on the page.
• Black boxes and deletions in a live .docx are not reliable redaction.
• Resolve the history, run Document Inspector, then remove the content and flatten it out of the editable format.
• Always verify: copy-paste the redacted zones on the output.