The two tools that prove their own result

A rectangle drawn on top of a name is a separate object in the file. The word underneath is still there, still selectable, still searchable and still recoverable by anyone who opens the document in something other than a viewer. That is the single commonest way sensitive text is published by accident. The redaction tool here draws every page as an image, paints your marks onto those pixels and builds a new document from the images, so the characters are destroyed rather than hidden.

It means the tool re-opens its own output from the finished bytes, exactly as a stranger receiving the file would, and measures it. Redaction runs five checks: every marked phrase searched for and not found, no extractable text at all, no annotations or form fields or attachments left, the page count unchanged, and every mark solid black in the finished page image. Password protection runs five of its own, including opening the file with no password and requiring that to fail. You see all five, with the number each one produced. If any fails there is no download — a result that cannot be proved is worse than none, because it is the one you would have sent.

The password tool writes AES-128 under the standard security handler at revision 4 — the encryption every PDF reader made since 2005 can open. It is not AES-256 and does not claim to be. What matters more in practice is that revision 4 derives its key with 50 rounds of MD5, which a laptop runs millions of times a second against a guess list, so the strength of the file really is the strength of the password. That is why empty passwords, anything under six characters and short runs of digits are refused outright.