Trying to Redact in Microsoft Word? Read This First

What Word is actually built for

Word is a word processor, and a very good one. It is the default choice for drafting contracts, letters, reports and pretty much anything else a UK office produces on paper or PDF. Most people reaching for a redaction workaround in Word are not confused about what it does; they are stuck with a file already in Word format and a deadline, and they reach for the tool already open on the screen. That is a completely reasonable instinct. It just does not solve the actual problem.

As of August 2026, nothing in the Word desktop app or Word Online adds a genuine redaction feature. Microsoft's own compliance product, Purview, sits in a different category entirely: it labels, classifies and restricts access to documents, which is useful for information governance, but it does not selectively strip text out of a page. If your task is send this document to someone but hide these three paragraphs, Word and its surrounding suite were never built to do that.

What happens to the underlying data when you 'redact' in Word

The common Word workaround is a black highlight or a shaded text box over the sensitive lines. Visually, this looks finished. Structurally, nothing has changed: the characters are still stored in the document's XML, still selectable, still copyable into a new file. Switch the highlight colour, delete the box, or paste the text into Notepad, and it is all still there. This is a formatting instruction sitting on top of untouched content, not a removal of that content.

A more careful approach, replacing specific strings with placeholder text via Find and Replace, at least removes the literal characters you searched for. But it only catches what you thought to search for. A disclosure bundle rarely leaks through the one name you were watching for; it leaks through the second reference to that name, a different spelling, a phone number in a signature block, a case reference buried in a footer. Manual search and replace has no concept of what a document contains beyond the string you typed.

Then there is everything sitting outside the visible page: tracked changes, comments, prior versions, author metadata, hidden text fields. Document Inspector was built specifically to strip this layer, and it does its job reasonably well, but it is a manual step you have to remember to run, it is desktop only, and it says nothing about the sensitive text still sitting in the body of the document. Two different problems, one partial tool, and no link between them.

Where the document sits matters more than it looks

For a firm handling client files, a public body responding to an FOIA request, or anyone processing personal data under UK GDPR, the question of where a document travels during redaction is not incidental. Desktop Word itself keeps files local. But a great deal of real world Word use runs through OneDrive or SharePoint, which means the document, and any comments or edit history riding along with it, is sitting in Microsoft's cloud rather than staying inside your own systems. That is a separate consideration from the redaction gap, but for anyone with client confidentiality obligations or a duty to account for where personal data has been, it compounds the problem rather than offsetting it.

RedactProof's document handling is the opposite by design: the file is opened, reviewed and exported entirely in your browser, and it never uploads anywhere. Only a cryptographic hash of the finished export goes to our servers, purely so a recipient can later confirm the certificate matches the file they received. For a solicitor redacting privileged material or a council officer preparing a SARs response, that distinction, no copy of the document ever leaving the device, is often the difference between a process that satisfies an information governance policy and one that creates a new disclosure risk on its own.

What the actual redaction step looks like instead

When we tested the two workflows side by side, the practical gap was less about any single feature and more about sequencing. In Word, you are running two disconnected processes, a metadata clean with Document Inspector and a manual visual edit, and hoping between them you have caught everything. In RedactProof, it is one pass: the document loads in the browser, automatic detection flags likely PII across the full text, and you review and approve or reject each suggestion before anything is touched. Nothing exports on the strength of the detection alone; a human confirms every redaction.

Once you approve the export, RedactProof does not lay a black box over the text, it removes the underlying content at the pixel level, so there is no layer to peel back later. The export also carries an Ed25519-signed verification certificate with a QR code. Anyone who receives the redacted file, whether that is a court, a data subject, or a colleague checking your work, can scan the code and confirm the file matches what was actually exported, with no account or software needed on their end. Word has no equivalent artefact: once a document leaves your outbox, there is no way for the recipient, or for you six months later, to confirm what was and wasn't removed.

Word for writing, RedactProof for redacting

None of this means abandoning Word. Word is where the document gets written, formatted and reviewed, and nothing here changes that. The redaction problem only appears at the very end, when a finished document has to leave your organisation, and that final step is the one thing Word was never built to do safely. So the two tools fit together rather than compete: keep drafting in Word, and add a redaction step at the point the file goes out.

So which one should you actually use

If the redaction is genuinely cosmetic, an internal draft where a black box is a visual cue rather than a disclosure control, and the file never leaves a small, trusted group, Word's highlight tool is fine for that narrow job, and it costs nothing extra since you already have it open. Document Inspector is also worth running as a habit even when the real redaction happens elsewhere; strip the metadata first, then hand the cleaned file to a dedicated tool for the part that actually matters.

But the moment a document is going somewhere with legal, regulatory or reputational consequences attached, court disclosure, an FOIA response, a client file leaving the firm, the tool doing the redacting needs to actually remove the content and be able to show it did. Word was never built for that job, and no amount of careful highlighting closes the gap.