What Does It Mean to Sanitize a Document?
Sanitize means three different things for a document: masking content, disarming active code, or wiping a device. Here is each one, plainly.
The word sanitize means three different things when it comes to a document. It can mean masking sensitive content before you share it. It can mean stripping out code that could carry malware. Or it can mean wiping a storage device for good.
People mix these up because the word sounds the same everywhere. A lawyer redacting a contract, an IT team blocking a macro, and an office disposing of old laptops are all sanitizing something. But they are solving three separate problems.
What does sanitize mean for a document?
For a single document, like a PDF or a Word file, only two of the three meanings usually apply. The first is privacy: hiding names, numbers and other sensitive details. The second is security: removing code that could run when someone opens the file. The third, wiping storage media, is a different job entirely.
| Meaning | Who uses it | What it removes | What it does not do |
|---|---|---|---|
| Privacy sanitization | Anyone sharing a document, or a masking tool | Sensitive text, metadata, comments, tracked changes | Does not remove malicious code or wipe a device |
| Security sanitization (content disarm and reconstruction) | IT security teams, secure email gateways | Macros, scripts, embedded files, active links | Does not judge whether content is sensitive to a reader |
| Media sanitization (NIST SP 800-88) | IT asset disposal teams | All recoverable data from a drive, phone or disc | Does not touch a single document you still use |
What is the difference between privacy and security sanitization?
Privacy sanitization looks at meaning. Someone decides a name, a price or a medical detail should not reach the next reader, then masks or removes it. A PDF editor's sanitize or remove hidden information command works this way. It strips the file's metadata, comments and other data the document carries without showing it on the page.
Security sanitization does not read the content at all. It looks for active code: instructions a file can run on its own. This process has a technical name, content disarm and reconstruction, or CDR. It strips or rebuilds anything that could execute, whether or not it turns out to be dangerous.
- Macros in Word, Excel or PowerPoint files: small programs that can run automatically when the file opens.
- JavaScript embedded in a PDF: can launch actions like opening a link or filling a field.
- Embedded files and attachments: a document hidden inside another document.
- Live links: can quietly load a tracking pixel or point to a fake page.
What is media sanitization?
Media sanitization is a different scale of problem. NIST, the US standards body, defines sanitization as a process that renders access to data on a storage device infeasible for a given effort. Its current guide, SP 800-88 Revision 2, published in September 2025, covers drives, phones and other media, not a single file. It groups methods into three levels: Clear, Purge and Destroy, from a basic overwrite to physically destroying the media.
Why does turning pages into images remove hidden content?
A document file is more than the text you can see. It can carry deleted paragraphs, author names, review comments, tracked changes and code the reader never notices. Content-security guidance from the UK's National Cyber Security Centre calls the safe way to strip all that transformation: rebuild the file in a simpler format, instead of cleaning the original piece by piece.
Turning each page into a flat image is one strict form of transformation. A picture cannot carry a macro, a script or a hidden layer, since it has none of the structure those things need to run. Whatever was masked on the page also stays masked, because there is no text underneath left to copy out.
ONYRI Sanitize sanitizes in the privacy sense: it masks detected and hand-picked content, then rebuilds each page as an image in a new file, a PDF, or a PNG for a single image, so the original's text layer, comments and document properties are not carried over. Its limit: it is not an antivirus or a certified disarm tool, and the output is not searchable text.
That safety has a cost. A flattened page is no longer searchable or selectable text, so copying a sentence into another file stops working. A screen reader used by a blind or low-vision reader cannot read it either, unless someone adds a separate text description. Weigh that against the document, before you flatten everything by default.
What is a good routine before you share a document?
A short routine covers most cases without slowing you down. Run through it before a document leaves your inbox, especially one you did not create yourself.
- Ask who actually needs to see the document, and what they need from it.
- Mask or remove names, numbers and other sensitive content, then check hidden metadata.
- If the file has macros or came from an unknown sender, keep them blocked, or convert the file to PDF.
- If a device, not a document, is being recycled or handed to someone else, wipe it properly first.
- Open the result and check it once more before you send it.
Jane Example, an office manager, now runs this checklist before every external email with an attachment. It takes her under a minute, and it already caught a spreadsheet with a hidden tab of salaries.
Frequently asked questions
Is a redacted PDF automatically sanitized?
Not necessarily. Redaction covers or removes what a reader can see on the page. A file can still carry hidden metadata, comments or an embedded macro underneath a black bar. True sanitization checks the whole file, not just the visible page.
Does converting a file to PDF sanitize it?
It helps, but it is not automatic. Printing a Word file to PDF drops its macros and tracked changes. The new PDF can still carry its own metadata, comments or JavaScript, so check the export settings or run a proper sanitize step afterward.
Do I need special software to sanitize a document?
For metadata and comments, many PDF and Office apps include a built-in command, often called remove hidden information or inspect document. For the sensitive content itself, you usually need a redaction or masking tool, since a plain black box drawn on top does not remove the text underneath.
Is wiping my old laptop the same as sanitizing a document?
No. Wiping a laptop is media sanitization: it targets the whole drive so nothing can be recovered from it. Sanitizing a document works on one file, whatever you later do with the device it was stored on.
Sources & references
- SP 800-88 Rev. 2, Guidelines for Media SanitizationNational Institute of Standards and Technology (NIST)
- Macros from the internet are blocked by default in OfficeMicrosoft Learn
- Design Pattern: Safely Importing DataNational Cyber Security Centre (NCSC UK)