The tools that prove their own result

A rectangle drawn on top of a name is a separate object in the file. The word underneath is still there, still selectable, still searchable and still recoverable by anyone who opens the document in something other than a viewer. That is the single commonest way sensitive text is published by accident. The redaction tool here draws every page as an image, paints your marks onto those pixels and builds a new document from the images, so the characters are destroyed rather than hidden.

It means the tool re-opens its own output from the finished bytes, exactly as a stranger receiving the file would, and measures it. Redaction runs five checks: every marked phrase searched for and not found, no extractable text at all, no annotations or form fields or attachments left, the page count unchanged, and every mark solid black in the finished page image. Password protection runs five of its own, including opening the file with no password and requiring that to fail. Removing a password runs four that point the other way, including opening the finished file with no password and requiring that to succeed. You see every one, with the number it produced. If any fails there is no download — a result that cannot be proved is worse than none, because it is the one you would have sent.

The password tool writes AES-128 under the PDF standard security handler at revision 4. It does not write AES-256 and does not claim to. The protection still depends on the password: revision 4 uses legacy password derivation, so a short or obvious password remains vulnerable to guessing. That is why empty passwords, anything under six characters and short runs of digits are refused outright. The unlock tool is the same handler read in the other direction: it opens a document with the password you supply and writes a copy that has none.

It removes a password you can already open the file with. It does not remove owner-password restrictions from a document that opens without a password — the settings that ask a reader not to print or copy. That case is detected and named rather than performed, because taking a restriction off a file its author restricted is a different thing from opening a file you own. It is also not a recovery service: a forgotten password cannot be found here, and no password you type reaches Steady PDF.