Best redaction software in 2026

Apple Preview

Since Ventura, Preview has had a real Redact tool that removes text from the file when you export. It is free, installed on every Mac, and for occasional single-document work it is genuinely all you need. We tell people this on our own homepage.

Where it fails: no batch mode, no automatic detection, nothing for scanned pages, and no verification. It also ships a Markup rectangle one menu away that looks identical but leaves text fully recoverable — the most common cause of accidental disclosure we know of. Our step-by-step guide covers the difference.

Smallpdf · iLovePDF

Both are fast, well-built browser tools with genuine redaction, and both are free for light use. If you need to redact something non-sensitive quickly on a machine you do not control, they are the path of least resistance.

Where it fails: the file leaves your computer. For a medical record, a client's discovery set or anything under NDA, the upload itself is the problem regardless of how good the vendor's security is — and in many cases regardless of what your professional obligations allow. Both are also single-file, with paid tiers for volume.

Adobe Acrobat Pro

The industry standard, and it earns it. Proper redaction with metadata sanitisation, search-and-redact across a document, OCR, plus the entire rest of the PDF toolset — forms, editing, conversion, signatures. If you work with PDFs all day in many different ways, this is the tool.

Where it fails: price, for anyone who only needs redaction. It is cloud-first by default, which is a compliance conversation in some firms. Batch redaction across a folder is possible but awkward, and there is no verification step — Acrobat does not check its own output either. Our Acrobat alternatives page breaks down what replaces it job by job.

DeepRedact

Ours. A desktop app for batch work: point it at a folder, it finds names, dates of birth, account and social security numbers across every file including scanned pages via on-device OCR, removes them from the content stream, and then re-opens each output to verify the strings are actually gone. Produces a per-file report. Nothing is uploaded, ever.

Where it fails: macOS only. It does not edit PDFs, fill forms, or convert anything — it does redaction and nothing else. It has no video or audio capability. And it is a single-machine desktop tool, so there is no shared workflow or team audit trail; a large firm with a compliance department will want one of the enterprise options below.

Objective Redact

Built for compliance and disclosure processes at organisations that do this at scale. Strong automatic detection, handles very large and complex documents, and produces the audit trail a regulated environment requires.

Where it fails: priced and sold for organisations, not individuals. Overkill for a two-person practice, and there is a procurement process attached.

Redactable

Cloud tool with AI-assisted detection and a workflow built for teams. Good if you want detection to do the heavy lifting and you are comfortable with documents being processed in the cloud.

Where it fails: cloud-based, so the same upload question applies. Subscription pricing accumulates.

CaseGuard · Veritone Redact

These solve a different problem: redacting faces, licence plates, screens and voices from video and audio, at the scale police departments and government agencies need. If body-cam footage is in scope, this category is the only real option and nothing else here competes.

Where it fails: not sensible for someone who just needs to redact PDFs. Priced accordingly.

iLovePDF says this inside its own redaction tool

“Remember to review the result of your document before sending private information.”

Verified on ilovepdf.com/redact-pdf. It is a responsible thing to put in the interface, and we are not criticising them for it. The point is what it admits: the vendor is telling you to check the output, because the tool does not.

That instruction appears, in some form, across this entire category. What none of these tools ship is a way to actually do the checking — which is the gap this whole page keeps circling.

Smallpdf's security copy is hard to reconcile

Four claims, all currently on smallpdf.com/redact-pdf:

• “No files left on our servers when you're done.”
• “Your files are automatically deleted after one hour.”
• “Process files 100% in your browser. Your documents download directly to your device and nothing is stored on our servers.”
• “Simply upload, remove sensitive data, and save.”

If nothing is stored, there is nothing to delete after an hour. The likeliest explanation is mundane — Smallpdf runs many tools, some in-browser and some server-side, and the security copy is written once for all of them. We are not alleging anything.

But it matters for one specific reader. If you have to answer a compliance officer asking where a client file was processed, you cannot answer it from that page, and “the marketing copy was ambiguous” is not an answer anyone accepts. That is a reason to prefer a tool where the question does not arise, whether or not it is ours.