Blot

Redaction that destroys what it covers.

The famous redaction failures all worked the same way: a black box drawn over text that was still there underneath. Blot cannot make that mistake, because it does not keep the text. Every page becomes a picture, your ink becomes part of the picture, and the finished file is re-checked to contain nothing extractable at all.

Choose a PDF or drop one here

Everything happens on this device. Nothing is uploaded, ever.

Why the output is a picture, not a document

A PDF is not what it looks like: under the visible page there can be a text layer, form data, comments, attachments, and earlier versions of the document. Tools that draw rectangles over that stack keep the stack. Blot renders each page to plain pixels and builds a brand new PDF containing only those pixels, so there is no stack left to leak. The cost is honest too: the output is a picture of a document, not an editable one.

What it refuses, on purpose

  • Password-protected files. Unlock them first; guessing at partial decryption is how tools mishandle documents.
  • Forms with filled-in fields, and XFA documents (a dynamic form format some government and legal PDFs use). Their content lives outside the page stream, where rendering can silently miss it. Print the form to a fresh PDF first, then bring that here.
  • Digitally signed documents. Flattening destroys the signature, and a redactor should not quietly do that to the one thing the file was for.

The Android app cannot phone home

Blot for Android requests no permissions at all. Your documents cannot leave the device through this app, and the manifest proves it.

It is not in the Play Store, so Android will warn you that it is blocking an install from outside the store. That warning exists for apps that ask for permissions and misuse them; Blot asks for none. Settings will offer a one-time "install anyway"; that is the only extra step.

Download the APK

One dependency, accounted for

Blot reads PDFs with Mozilla's PDF.js, the same engine Firefox uses, vendored at a pinned version whose checksum is verified against the public registry and documented in the repo. Everything else is dependency-free.