Bank Statement Sanitizer + Loan Upload Pack — Free Online Bank Statement Sanitizer + Loan Upload Pack

How do I redact a bank statement before sharing it?

Upload your bank-statement PDF, drag black boxes over the account number, sort code/IFSC and balances, then export. The tool flattens each page to an image with the boxes burned in, so the hidden text is truly removed — not just covered — and the whole process runs in your browser, never uploaded.

Draw solid-black redaction boxes over anything sensitive, on every page
Optional auto-suggest finds long digit runs, IFSC/PAN and labelled balances
Export rebuilds the PDF from flattened page images — no recoverable text layer
100% client-side — your statement is never uploaded to any server
Keep your name, address and date visible for proof of address

What is

True redaction (flatten / rasterize)

True redaction permanently removes sensitive content from a document rather than just hiding it behind a coloured box. Drawing a black rectangle in a PDF editor leaves the original text in the file, where it can still be selected, copied or lifted back out — a mistake that has leaked real account numbers and court secrets. The reliable client-side way to redact for real is to flatten (rasterize): render each page to an image, paint the black boxes onto that image so the underlying pixels are physically replaced, and rebuild the PDF from the images. The result has no text layer under the boxes, so the blacked-out data is gone and cannot be recovered. The trade-off is that the output is image-based and therefore no longer selectable or searchable, and the person redacting is responsible for covering everything sensitive.

Generators

Related terms

Redacted bank statementFlatten PDFRasterize PDFBlack box redactionAccount number maskingProof of address

Frequently Asked Questions

Open the Bank Statement Sanitizer and upload your statement as a PDF or image. Each page is rendered in your browser, and you drag your mouse or finger to draw a solid-black box over the account number, the sort code / IFSC / routing number, any card numbers, the balances and any transactions you do not want to share — on every page. An optional Auto-suggest button scans a digital PDF’s text layer for long digit runs, IFSC/PAN patterns and labelled balances and proposes boxes you can confirm or remove. When you export, the tool draws each page image to a canvas, fills your boxes with solid black so the pixels underneath are physically replaced, and rebuilds a brand-new PDF from those flattened images — so there is no text layer left under the boxes to copy. The redacted PDF downloads to your device; nothing is ever uploaded.

Upload the statement PDF, drag a black box over the account number (and sort code/IFSC and balances), then export. The page is flattened to an image so the number is truly removed, all in your browser.

Drawing a black rectangle in most PDF editors only adds a visual layer; the original text is still in the file. Anyone can select and copy the “hidden” line, run the file through a converter, or move the box — and the sensitive data is revealed. This has caused real leaks of bank details, names and court secrets. To redact for real, the underlying content has to be removed, not just covered. This tool does that by flattening: it renders each page to an image, paints your black boxes onto the image so the pixels under them are replaced, and rebuilds the PDF from the images. The output has no text under the boxes, so the blacked-out account number, balance or transaction cannot be recovered.

No. A black box drawn in a normal PDF editor only sits on top — the text underneath survives and can be copied, searched or lifted back out. Real redaction must remove the underlying content.

The Bank Statement Sanitizer runs completely client-side. Pages are rendered with pdfjs and the redacted PDF is assembled with pdf-lib — both load from the app’s own bundle, with no server, no API, no AI and no CDN call for your document — and the page works offline once cached. The statement you upload never leaves the page; nothing is sent, logged or stored. That is the key difference from many online redaction tools, which upload your file to their servers — the exact opposite of what you want when the whole point is to hide your account number, balances and transactions. Only the redacted PDF you choose to export ever leaves the page, and closing the tab discards everything.

No. The PDF is opened, rendered, redacted and rebuilt entirely in your browser. Nothing is sent to a server, so it is safe for a confidential statement.

When you share a statement as proof of address or income for a loan, rental, job or visa, the recipient usually only needs your name, residential address and the statement date — so keep those visible. Black out the full account number, the sort code / IFSC / routing number, any card numbers, and the balances, because a routing/sort code combined with an account number can be enough to set up unauthorised withdrawals. Also redact any SSN / PAN / Aadhaar / TIN, and if the recipient does not need your spending, the individual transactions and merchant names. It is legal to hide your own details, but you must only redact — never change a figure, as altering numbers is document tampering, not redaction. Auto-suggest is best-effort, so zoom in and review every page yourself before sharing; you are responsible for what stays visible.

For proof of address, keep your name, address and statement date visible; black out the account number, sort code/IFSC/routing, card numbers and balances — and transactions if the recipient does not need them. Never alter the numbers.

Bank Statement Sanitizer

Upload a bank-statement PDF or image, draw solid-black redaction boxes over the account number, sort code/IFSC/routing, card numbers, balances and transactions (optionally auto-suggested from the text layer), and export a truly-redacted PDF. Export works by flattening: each page is rendered to an image, the black boxes are burned into the pixels, and the PDF is rebuilt from the images — so the hidden text is physically removed with no recoverable text layer, unlike a black box drawn in a PDF editor. Everything runs in your browser; nothing is uploaded.

Features

Renders each PDF/image page in the browser with pdfjs and rebuilds the PDF with pdf-lib — all client-side, no CDN
Draw movable, removable solid-black redaction boxes per page (mouse or touch) over anything sensitive
Optional auto-suggest scans a digital PDF’s text layer for long digit runs, IFSC/PAN and labelled balances
TRUE redaction by flatten/rasterize — flattened page images, so the blacked-out text is gone, not just covered
100% client-side — statement never uploaded; you must cover everything & review every page before sharing

PriceFree

CategoryGenerator

PlatformAll (browser-based)

PrivacyThe uploaded statement is opened, rendered, redacted and rebuilt locally and never uploaded, logged or stored — safe for confidential bank statements

Input: Bank-statement PDF (digital or scanned), Statement image (PNG, JPG, WebP, etc.)

Output: Truly-redacted, flattened PDF (image-based), Print (flattened, redacted pages)

Detailed Explanation

Methodology

Why a Black Box Is Not Redaction — and How Flattening Fixes It

AnyTool’s Bank Statement Sanitizer performs TRUE redaction entirely in the browser, and the core idea is that drawing a black rectangle in an ordinary PDF editor is not redaction at all. A PDF stores text, images and annotations as separate objects, so a black box added on top is only a visual layer — the original characters underneath remain in the file and can be selected, copied, searched or lifted back out with any converter (the failure that has leaked real bank account numbers and court secrets). The reliable client-side way to redact for real is to FLATTEN / RASTERIZE: render each page to a bitmap, paint the black boxes onto that bitmap so the pixels under them are physically replaced, then rebuild the PDF from the images so there is no text layer left to recover. This tool renders every page with pdfjs-dist at 2× scale to a canvas; the user drags solid-black redaction boxes over sensitive areas; on export it draws each page bitmap onto an off-screen canvas, fills the boxes with solid black, embeds that flattened canvas as a PNG and assembles a brand-new PDF with pdf-lib. The blacked-out account number, balance or transaction is gone, not merely covered.

A black box drawn in a PDF editor leaves the text underneath — copyable, searchable and recoverable
True redaction must REMOVE the underlying content, not just hide it
Reliable client-side method = flatten/rasterize: render to image, paint boxes, rebuild PDF from images
pdfjs renders each page to a canvas at 2× scale; pdf-lib embeds the flattened PNG into a new PDF
The exported PDF has no text layer under the boxes, so the hidden data cannot be lifted back out

Technical Details

Drawing Boxes, Multi-Page Redaction and Best-Effort Auto-Suggest

Redaction boxes are drawn directly on the rendered page with pointer events (mouse or touch): the user drags to create a solid-black box, boxes are stored per page in the page’s rendered-pixel space, and each can be removed with its × handle or cleared per page / for the whole document. Multi-page statements show one page at a time with page tabs that badge how many boxes each page carries, and the boxes are re-applied at the correct positions when the PDF is flattened. An optional Auto-suggest scans only a digital PDF’s embedded text layer (captured from pdfjs with each item’s X/Y position, flipped to a top-left origin) and proposes boxes for likely-sensitive tokens: long digit runs of nine or more digits (account / card / IBAN-style numbers), 13–19-digit card numbers, Indian IFSC (four letters, a zero, six alphanumerics) and PAN (five letters, four digits, a letter), UK sort codes, and currency amounts that sit next to a balance/closing/opening label. Auto-suggest deliberately over-matches and is explicitly best-effort — the user confirms or removes each box — and it does nothing on an image, which has no text layer; everything must then be drawn by hand.

Solid-black boxes drawn with pointer events; per-page, individually removable, clear-page and clear-all
Multi-page: page tabs badge each page’s box count; boxes re-applied at flatten time
Auto-suggest scans only a digital PDF text layer using each item’s pdfjs X/Y position
Matches long digit runs, card numbers, IFSC, PAN, UK sort codes and balance-labelled amounts
Auto-suggest over-matches on purpose and is best-effort; images have no text so must be redacted by hand

Privacy & Security

Privacy and the Honest Limits

The whole pipeline — opening the file, rendering pages, drawing boxes, flattening and rebuilding the PDF — runs in the browser. There is no server, no API, no AI/LLM and no CDN call for the document, and the page works offline once cached, so a confidential statement (with its full account number, balances and every transaction) never leaves the device; only the redacted PDF the user exports ever leaves the page, and object URLs are revoked after download. This is the deliberate contrast with online redaction tools that upload your file to a server — the exact opposite of what you want when the goal is to hide sensitive data. The tool is equally clear about the trade-offs: because it relies on the user’s boxes, YOU are responsible for covering every sensitive item — zoom in and review every page before sharing; auto-suggested boxes are best-effort and may miss or mis-place items; and the output is an image-based PDF, so it is no longer selectable or searchable. It is also for hiding, not altering — redact figures, never change them, since changing numbers is document tampering rather than redaction.

Redacting a bank statement: AnyTool vs PDF-editor black box vs online redaction tool
Capability	AnyTool	Black box in a PDF editor	Online redaction tool
Approach	In-browser flatten/rasterize: render → paint boxes → rebuild from images	Draws a rectangle over the text	Server-side redaction / OCR
Is the hidden text removed?	Yes — no text layer under the boxes	No — text survives, copyable & recoverable	Sometimes — depends on the tool
Input	Statement PDF (digital or scanned) or image	PDF	PDF / image
Output	Truly-redacted, flattened image-based PDF + print	PDF that still leaks the text	Redacted PDF
Processing	Runs in your browser	Runs locally	Uploads your statement
Privacy	Never uploaded; safe for confidential statements	Local, but unsafe redaction	Account no., balances & transactions sent off-device
Honesty	States you must cover everything & review every page	—	Marketing may overstate security

AnyTool flattens each page to an image with your boxes burned in so the hidden text is physically removed; it never uploads the file — but you are responsible for covering everything and reviewing every page before sharing.

Cite This Page

Title: Bank Statement Sanitizer (in-browser TRUE redaction of a bank-statement PDF — draw black boxes over the account number, balances and transactions, then export a flattened, image-based PDF where the hidden text is physically removed and cannot be recovered — nothing uploaded)
Author: AnyTool
Published: January 1, 2026
Modified: February 8, 2026
Section: Generators
URL: https://www.anytool.tech/bank-statement-sanitizer

Formatted Citation

AnyTool. "Bank Statement Sanitizer (in-browser TRUE redaction of a bank-statement PDF — draw black boxes over the account number, balances and transactions, then export a flattened, image-based PDF where the hidden text is physically removed and cannot be recovered — nothing uploaded)." AnyTool, January 1, 2026. https://www.anytool.tech/bank-statement-sanitizer

A privacy-first, 100% client-side Bank Statement Sanitizer that performs TRUE redaction on a bank-statement PDF or image entirely in the browser, with no upload, server, API, AI/LLM or CDN call for the document and offline support once cached, so even a confidential statement with its full account number, balances and every transaction never leaves the device. The core insight is that drawing a black rectangle in an ordinary PDF editor is not redaction: a PDF stores text and graphics as separate objects, so a box added on top is only a visual layer and the original characters remain in the file, where they can be selected, copied, searched or lifted back out with any converter — the failure that has leaked real bank details and court secrets. The reliable client-side way to redact for real is to flatten / rasterize: render each page to a bitmap, paint the black boxes onto that bitmap so the pixels underneath are physically replaced, then rebuild the PDF from the images so there is no text layer left to recover. The tool renders every page with pdfjs-dist at 2× scale onto a canvas (the bundled worker, no CDN); the user drags solid-black redaction boxes with pointer events (mouse or touch) over the account number, sort code / IFSC / routing number, card numbers, balances and any transactions, with boxes stored per page in the page’s rendered-pixel space, individually removable via an × handle, and clear-page / clear-all controls, while multi-page statements use page tabs that badge each page’s box count. An optional, explicitly best-effort Auto-suggest scans only a digital PDF’s embedded text layer (each item’s X/Y position captured from pdfjs and flipped to a top-left origin) and proposes boxes for likely-sensitive tokens — long digit runs of nine or more digits, 13–19-digit card numbers, Indian IFSC and PAN patterns, UK sort codes, and currency amounts adjacent to a balance/closing/opening label — deduplicating against existing boxes; it over-matches on purpose so the user confirms or removes each box, and it does nothing on an image, which has no text layer. On export the tool draws each page bitmap onto an off-screen canvas, fills the user’s boxes with solid black, embeds that flattened canvas as a PNG and assembles a brand-new PDF with pdf-lib at the page’s pixel dimensions, then downloads it (object URLs are revoked afterward); a Print option opens the same flattened pages for printing. The page is explicit and prominent that this is real redaction by flattening but that the responsibility is the user’s: you must cover EVERY sensitive item and zoom in to review every page before sharing, auto-suggested boxes are best-effort and may miss or mis-place things, the output is an image-based PDF so it is no longer selectable or searchable, and it is for hiding rather than altering — redact figures, never change them, since changing numbers is document tampering rather than redaction. On privacy, the file is opened, rendered, redacted and rebuilt only on the device, nothing is sent, logged or stored, and only the redacted PDF the user exports ever leaves the page — the deliberate contrast with online redaction tools that upload your file to a server, the exact opposite of what you want when the goal is to hide your account number, balances and transactions, making it suitable for redacting a statement before sharing it as proof of address or income with a lender, landlord, employer or visa office.