Spots 
Drawing a black rectangle over sensitive text in a PDF does not redact it. I need you to understand this before anything else, because people get fired, sued, and embarrassed over this exact mistake.
A PDF is not an image. When you draw a black box over text, you're adding a new object on top of the text. The text is still there, in the file, in the content stream, fully selectable, copyable, and extractable. Anyone who selects the "redacted" area and pastes it into a text editor gets your secrets. Anyone who runs a text-extraction script gets all of them at once. This has happened to governments, law firms, and newspapers. It's not a theoretical risk. Before trusting any redaction, do this: Try to select the text underneath a black box with your cursor. Copy it. Paste it into a text editor. If anything pastes, the redaction failed. It doesn't matter what the tool promised. The file is the truth.
For a stronger check, run a text extraction tool over the whole document and search the output for the sensitive terms. If they appear, the content stream still contains them. What proper redaction actually means Real redaction has two parts, and both are required:
Remove the content from the file. The text-showing operations for the sensitive content must be deleted from the page's content stream — not covered, deleted. The bytes should not exist in the exported file.
Burn the visual mark into the page. The black box should be part of the rendered page content, so the document still reads naturally with visible redaction marks. If a tool only does step 2, it's a highlighter with bad intentions. How to do it properly (step by step)
Using PDF Studio (free, runs in your browser, no signup — and relevantly, your document never uploads anywhere, which matters when the document needs redacting): Open https://navigatorslab.com/pdf-studio/ and load your PDF. Nothing uploads; everything happens on your machine.
Select the redaction tool and mark every piece of sensitive text. Be thorough — and don't forget metadata-adjacent content: headers, footers, and text baked into scanned images needs OCR-aware handling.
Apply the redaction and export the PDF. The export rewrites the page content streams with the marked content removed, then burns in the black boxes.
Verify. This step is not optional. Open the exported file, try the 30-second select-and-copy test on every redacted region. Then run text extraction across the whole document and search for the sensitive terms. They should be absent.
Check the document metadata too (File → Properties in most readers). Author names and revision history have leaked through "redacted" documents before. What about scanned documents?
Drawing a black rectangle over sensitive text in a PDF does not redact it.