Redact a Bank Statement Before Sending It
A bank statement is requested constantly — for a rental application, a visa file, a loan, a mortgage broker. The recipient usually needs to see that money moved, not where it went or which account it came from. Those are different redactions.
Free, no account, and the image never leaves your browser.
A statement discloses behaviour, not just numbers
People think of a statement as financial data, and the balances are the part they guard. In practice the transaction list is the more revealing half. It shows where a person lives — rent, utilities, a local supermarket. It shows who they support, which medical providers they use, which subscriptions they hold, and what their habits are. A month of transactions is a behavioral profile.
The account and routing numbers are a different category of risk. They are not card credentials and they cannot be charged directly, but combined with a name and an address they support direct debit fraud and, in the US, are the standard inputs to an ACH pull. Statements print them in full, usually at the top of the first page.
There is a distribution problem too. A statement submitted for a rental application passes through a letting agent, possibly a background check service, and ends up in an email thread. Each copy is a full disclosure, and the original is rarely deleted. Reducing the statement to the minimum a recipient needs is not paranoia; it is the standard practice in jurisdictions with data minimization requirements.
What a recipient actually needs versus what is printed
Decide this before you start drawing boxes. Covering the wrong things means resending, and resending means another copy exists.
- Account and routing numbers
- Printed in full at the top of a statement. Cover both, plus any repetition in a footer or a summary box.
- Statement period and closing balance
- Usually what the recipient is verifying. Keep these unless the request explicitly does not need them.
- Individual transaction descriptions
- The merchant names are the behavioral profile. Cover rows that reveal medical providers, religious organizations, political donations, or personal relationships.
- Full name and postal address
- Printed in the header block. The name usually needs to stay if the statement is evidence of income; the street address often does not.
- Account holder identifiers beyond the name
- Customer numbers, tax identifiers, and relationship-manager references. None of them help a recipient verify income.
- Card numbers in the transaction detail
- Some statements list the card used for each purchase, including the last four digits. Cover the ones you do not need to show.
- Barcodes and statement IDs
- Machine-readable identifiers on e-statements. They can resolve to the full document on the issuer's system.
Detection helps with the numbers, not the story
The patterns that match here are the account numbers and any email or phone in the header. The transaction narrative — which is the more sensitive part — is not something pattern matching can address.
Found automatically
- Card numbers of 13 to 19 digits that pass the Luhn checksum
- IPv4 addresses, which occasionally appear in a footer or a statement ID
- Email addresses in the header block
- US phone numbers
- Social Security numbers in the separated form, when a statement prints one
Needs a box by hand
- Account and routing numbers. They are not one of the six matched patterns, so cover them by hand every time.
- Merchant names, which are the behavioral disclosure.
- Balances and transaction amounts.
- Customer numbers and statement identifiers.
- Barcodes and QR codes.
- Any text in a scanned or photographed statement, where accuracy drops sharply.
Producing a statement you can send
If you have the PDF, export the page to an image first. Editing a PDF leaves a readable text layer underneath an overlay, which is the single most common way a redacted financial document leaks.
Convert the page to an image
Take a screenshot of the page or export it as PNG. Image space is the only place where a redaction actually removes content, because there is no text layer left to read.
Open the image here
Drop, paste, or choose the file. It is decoded in the tab and never uploaded.
Cover the account and routing numbers first
They are at the top of page one and are the fields with the most direct abuse path. Use solid black.
Decide on the transaction rows
Cover the rows that disclose location, health, or relationships. Leaving everything visible is a choice, not a default; make it deliberately.
Cover the header identifiers
Customer number, tax identifier, and any barcode. These are the fields that let someone pull the original document.
Export and verify
Open the PNG and check that no account number is partially visible. Then check the page edge — statement layouts often repeat an identifier in a margin.
Why PDF redaction fails and image redaction does not
A PDF stores text as glyphs with positions, in a text layer, and draws them. Adding a black rectangle to a PDF adds a drawing object on top of that text layer. The text is still there. Selecting the area, copying it, running text extraction, or opening the file in a different viewer can expose the content that the black box was supposed to hide. This has caused real, documented disclosures from courts, law firms, and government agencies.
Proper PDF redaction requires removing the underlying glyphs, which is a destructive operation and not something most consumer tools do. The reliable alternative, when you only need to share a page, is to rasterize it: turn the page into an image, then redact the image. What is left is pixels with no text layer.
That is the workflow this tool supports. It works on images, not PDFs, by design. Convert first, then redact.
One consequence worth stating plainly: rasterizing makes the text unselectable for legitimate recipients too. If you are sending a statement to a mortgage broker who needs to extract figures, they will have to read it rather than copy it. That is a real trade-off, and shipping a rasterized redaction is usually still the right call for a document you are handing to a third party.
Frequently asked questions
- Can I redact a PDF directly?
- Not with this tool. It works on images. Convert the PDF page to a PNG first — a screenshot is usually the fastest route — and redact the image. Redacting a PDF with an overlay leaves the original text readable underneath.
- Which numbers on a statement are the dangerous ones?
- The account number and the routing number. Together with a name they support direct debit fraud, and unlike a card number they are not routinely rotated.
- Do I need to hide every transaction?
- Not necessarily. Decide what the recipient is verifying — usually income or a balance — and cover the rows that disclose information unrelated to that. A rental agent needs to see deposits, not your medical appointments.
- Does the exported image keep the statement's metadata?
- The export is a new PNG encoded from canvas pixel data, so the source image's metadata structure is not carried over. If the original PDF had document properties, those are not part of the image at all.
- Is anything uploaded while I do this?
- No. There is no upload step and no server-side processing. The image is decoded in the browser tab and the download is created locally.