Tax documents are identity-theft gold: your SSN, your address, your income, your bank account numbers, your employer, your dependents' names. Anyone you email an unredacted W-2 or 1040 to has full access to the kind of information scammers need to open credit cards in your name or intercept your next refund.
Most of the time, the recipient (mortgage broker, new accountant, lawyer handling a divorce, ex-spouse's attorney, college financial aid office) doesn't need all that data. They need income verification, or they need to see specific line items, or they need employer information for a claim. You can redact everything else and still meet the actual ask — which is exactly what this page is about.
These are the categories where you typically have discretion. Always confirm with the specific recipient what they need to see — some regulated contexts (certain mortgage products, IRS audit responses) require unredacted returns.
Full SSN of you and spouse (keep last 4), dependents' full SSNs, bank routing/account for refund or payment, preparer info.
Full employee SSN, employer EIN if sensitive, home address if safety concern. Keep employer name and wage info for verification.
Full recipient SSN, payer's full TIN (keep last 4). Keep gross amounts and payer name for verification.
Brokerage account numbers, full SSN, payer's TIN. Keep the income figures and the payer name.
Your EIN (keep last 4), home office address if it's your home, specific client names if confidential.
Property addresses if safety concern, tenant names/payment info, specific buildings' financial data if confidential.
Similar rules to federal — SSN, bank info, dependents. Some states print driver's license numbers; redact those too.
Full SSN, PIN, self-selected PIN. This form is authentication material; share only if specifically requested.
Keep: Income, employer info, tax paid, AGI.
Redact: Full SSN (keep last 4), bank account numbers on refund line. Check with your loan officer — Fannie/Freddie rules sometimes require full SSN.
Keep: Full prior-year return is usually needed for continuity.
Redact: Bank account numbers for refunds. Your new accountant will typically need the rest to prepare this year's return accurately.
Keep: All income lines, deductions, schedules.
Redact: Dependents' SSNs (court usually wants initials), direct-deposit account numbers if you've changed banks.
Keep: AGI, income lines, certain deductions.
Redact: Full SSN after aid office has confirmed identity another way. Ask first — some require full SSN for verification.
Keep: Full return — SBA typically requires unredacted returns as part of Form 4506-T authorization.
Consider: Requesting a secure portal rather than email for transmission.
Keep: What was ordered by the court.
Redact: Dependents' SSNs (use initials), new-spouse info if filed jointly post-divorce and not relevant, current bank account numbers.
Open the PDF, draw boxes over SSNs and account numbers, export a truly redacted file. Nothing uploaded, nothing stored, nothing seen by FilePulp.
Open the Redaction Tool →Your tax return is the single most identity-theft-valuable document most people own. SSN + DOB + employer + address is enough to open credit cards, intercept refunds, and apply for loans in your name. Uploading a return to a third-party "free PDF editor" — even briefly — adds an attack surface that doesn't need to exist.
FilePulp's redaction tool runs entirely in your browser. The file is loaded into your browser's memory via the FileReader API, rendered with pdf.js, and exported via pdf-lib. At no point does any content travel over the network. You can verify this yourself by opening DevTools → Network before uploading; you'll see zero outbound requests carrying file data. You could disconnect from the internet after the page loads and the tool still works.
FilePulp never receives your return. There's no server to breach, no retention policy to trust, no audit log to subpoena. For the one document category where "just trust us" isn't good enough, architectural privacy beats a promise.
Yes. You own your return. You can redact any information before sharing it with a lender, accountant, family member, or attorney. Redacting is a recommended identity-theft prevention practice. The IRS only restricts how professional preparers handle client returns (IRC § 7216); it doesn't restrict how you share your own.
Most lenders need income and employer verification, not your SSN or dependents' info. Typical redactions: your full SSN (keep last 4), dependents' full SSNs and full names (initials OK), bank account/routing for the refund, employer EIN. Always confirm with your specific lender — conforming loans (Fannie/Freddie) sometimes require full SSN.
No. On export, each page is flattened to a high-resolution image. Text under your redaction boxes is physically destroyed — not hidden, not covered. Copy-paste returns nothing for the redacted areas; text search returns nothing; PDF text extraction tools return nothing.
No. FilePulp runs entirely in your browser. No file data is ever transmitted to us or any server. Open DevTools → Network before using the tool and confirm — zero outbound requests carry your file content. Your SSN, income, and financial details never reach FilePulp.
Yes. Open the PDF in the redaction tool and work through each year's return page by page. Browser memory is the only practical limit — most consumer returns (even 3-year packages) fit comfortably.
Most will, but ask first. If they need historical data to complete this year's return (carryforwards, prior-year basis, AMT history), redact only identity info and bank numbers — leave the tax figures intact.
Redact your tax return in seconds. Free, secure, browser-only, never uploaded.
Redact My Tax Return →Bank Statements · Medical Records · Legal Filings & Contracts · Screenshots & Photos