--- title: "How to Redact a Word Document" description: "Highlighting text in black is not redaction, and neither is deleting it with track changes on. Omit removes the value from the file itself, across headers, footers, comments, footnotes, tracked deletions and document properties, entirely offline." canonical_url: https://omitsys.com/blog/how-to-redact-a-word-document/ author: "Ranjan Singh" date: 2026-08-23 published: false --- ## In short A .docx is a zip of XML, so the test for a redaction is whether the string is gone from the package rather than hidden in the window. Word keeps text in places the page does not show: headers, footers, comments, footnotes, text boxes, the deletion elements that track changes creates, and the author and last-modified-by fields in document properties. Omit rewrites the stored text across all of them. RTF, the older binary .doc format, field codes and pictures embedded in a document are not covered. Word gives you at least four ways to make text look removed, and none of them remove it. You can highlight it in black, which changes a colour attribute and leaves every character in place. You can set the font colour to white, which is the same trick with a different attribute. You can draw a shape over it, which adds a shape. Or you can delete it with track changes switched on, which moves the text into a deletion element where it sits, in full, until someone accepts the change. All four survive a copy and paste. Three of them survive being converted to PDF. ## A .docx is a zip of XML, and that is the standard A .docx is a zip archive of XML files, and that is the useful thing to know about it. Anything you can read in Word is a string inside one of those XML parts, and so is a great deal you cannot read in Word. Rename a copy to .zip, open it, and the text is right there. That is the standard by which a redaction has to be judged: not whether the value is hidden in the window, but whether the string is gone from the package. Omit redacts the string. The text nodes themselves are rewritten, the file is rebuilt around them, and everything the redaction did not touch is copied across unchanged. A document with nothing to redact comes back with its parts intact rather than re-serialised, which matters more than it sounds: rewriting a Word file wholesale is how tools quietly break numbering, styles and change tracking on documents that never needed editing at all. ## The text a Word file keeps off the page Then there is the part most tools skip, and it is the part that leaks. A Word document keeps text in a lot of places that are not the page you are looking at. Headers and footers carry the matter name, the client name, the firm's own footer block, and a page-one review almost never scrolls into them. Comments carry exactly the material nobody meant to send: the question about the client, the note about the other side, the name of whoever asked. Footnotes and endnotes are separate parts of the package again. Text boxes and table cells sit inside the body but are easy for a naive pass to walk past. Omit scans all of them, because a name redacted on the page and left in the footer is not redacted. ## Tracked deletions are the black rectangle of Word Tracked deletions deserve their own paragraph. When track changes is on and you delete a name, Word does not remove it; it moves it into a deletion element and stops drawing it normally. The characters are still in the file, and anyone who opens the document and switches the view can read them. This is the closest Word equivalent of the black-rectangle-over-PDF-text failure, and it is more common, because deleting text with track changes on is not a mistake anyone thinks they are making. Omit treats that deleted text as text, finds the PII in it, and rewrites it like anything else. ## Document properties, the most forgotten one Document properties are the last one, and the most consistently forgotten. Every .docx carries an author name and a last-modified-by name, plus a title, subject, keywords and description, none of which appear anywhere on the page. A file that has been through three people carries the third one's name whether or not anybody wanted it there. Omit reads those fields as text and puts them through the same detection and the same policy as the body, so they show up in the review dialog and in the audit report rather than being silently stripped or silently kept. ## What happens to a matched value What actually happens to a matched value is the same per-type policy the rest of the product uses. A name can be replaced with its type, blacked out, reduced to initials, or swapped for a consistent fake name that keeps the document readable. An account number can keep its last four digits. A date of birth can be reduced to its year. Those last three exist because a court rule asks for exactly those shapes, and they are covered in the post on [redacting a court filing under Rule 5.2](/blog/how-to-redact-a-court-filing/). ## Names split across runs One detail that matters in practice: Word splits a single word across several runs all the time, because of spell-check state, a stray formatting change, or an edit made months ago. "Marta Kovacs" can be stored as three separate pieces. A tool that redacts run by run either misses the name entirely or catches half of it. Omit reads the paragraph as the continuous text a person would read, finds the value across whatever run boundaries happen to fall inside it. [Checking afterwards that the value is really gone](/blog/how-to-unredact-a-pdf/) has to close those same run boundaries first, or a raw search of the file reports a name it can plainly see as absent, and writes the replacement back into the runs it spanned. ## The rules that hold, and the limits The rules the rest of the product runs on hold here without exception. Your original file is never modified: redaction writes a new file and leaves yours exactly as it was. The write is atomic, a temp file followed by a rename, so a crash mid-write cannot leave a half-written document where your data used to be. And the whole pass runs on your machine, with no upload, no account and no API key. Three limits worth having from us rather than discovering. RTF and the old binary .doc format are not read yet; save as .docx or export to PDF. Field codes, such as the instruction inside a HYPERLINK field, and the link targets stored in the package's relationship files, are not rewritten, so a mailto address that exists only as a link target rather than as visible text will not be caught by an automated pass. And a .docx can carry pictures: a pasted screenshot, or the page-one thumbnail Word saves when that option is on. Those are pixels rather than text, so a Word pass does not read them and does not redact them. Redact the image separately, or export the document to PDF, where the OCR path does cover it. If you want to be sure about a specific document, the omit verify command will tell you whether a given value is still recoverable from the file after the fact. That is the check worth running on anything that has been redacted by any tool, ours included.