How to Redact a W2 Form

A W-2 is a single page of paper that, in the wrong inbox, is everything someone needs to file a fraudulent tax return in your name. It pairs your full Social Security number with your full legal name, your home address, your employer, and your annual wages — exactly the dataset criminals use to claim refunds before you do.

You can still hand a W-2 to a landlord, a background-check company, or a lender — but not the raw scan. This guide shows you what to redact, what to keep visible so verification still works, and how to do it without leaving recoverable layers in the file.

What's actually on a W-2

The W-2 packs more identifiers per square inch than almost anything else you receive in the mail. Every box matters from a redaction standpoint:

• Box a — Employee SSN: your full nine-digit Social Security number.
• Box b — Employer EIN: the employer's federal tax ID. Not your PII, but identifies the company.
• Box c — Employer name and address.
• Box d — Control number: internal payroll identifier (used for re-issue requests).
• Box e/f — Employee name and home address.
• Box 1 — Wages, tips, other compensation: the taxable income figure most verifiers actually want.
• Box 2 — Federal income tax withheld.
• Boxes 3–6 — Social Security and Medicare wages and tax.
• Boxes 15–20 — State / local wages, tax, and state employer ID.

A complete W-2 is enough to file a fraudulent return, open a credit account, or pass a basic identity quiz at a call center. The IRS itself flags it as one of the highest-value documents thieves target — phishing campaigns against payroll departments specifically asking for W-2 files are a recurring threat the agency tracks under Form W-2/SSN data theft.

What landlords, lenders, and background-check firms actually need

Despite asking for "your W-2," almost no verifier needs every box. They are confirming a small number of facts:

1. Identity: the name on the W-2 matches the name on the application.
2. Employer: you actually work where you say you work.
3. Income: your wages support the rent, the loan, or the role you're being hired into.
4. Recency: the W-2 is from the correct tax year.

None of those checks require your SSN. None of them require your home address (the landlord already has your application). The verifier's job is to compare wages to a threshold, not to reproduce your tax file.

What to redact vs. keep on a W-2

Field	Action	Why
Box a — Full SSN	REDACT (last 4 OK)	The single highest-value field on the document.
Box b — Employer EIN	REDACT if not requested	Not your PII, but lets a thief impersonate your employer in support calls.
Box d — Control number	REDACT	Used by payroll to re-issue documents.
Box e — Employee name	KEEP	Proves the document is yours.
Box f — Home address	REDACT for unfamiliar recipients	Skip if the recipient already has it on file.
Box c — Employer name/address	KEEP	This is what employment verification confirms.
Box 1 — Wages	KEEP	The figure verifiers compare against thresholds.
Box 2 — Federal tax withheld	OPTIONAL	Some lenders use it to estimate net pay; redact otherwise.
Boxes 3–6 — SS / Medicare	OPTIONAL	Redact unless the verifier explicitly asks.
Boxes 15–20 — State	REDACT the state employer ID	State wages are fine; the ID isn't needed.

How to redact a W-2 properly

The single rule that matters: the redaction must remove the data, not just hide it on the screen. A black rectangle drawn on top of an image, or a "highlight" applied in a PDF reader, leaves the original text intact underneath — anyone with a copy of Adobe Acrobat or even a free PDF tool can lift the layer.

1. Start from a clean export. Download the W-2 PDF directly from your employer's payroll portal, or scan the paper copy at 300+ dpi. Don't redact a phone photo of a phone screen.
2. Use true redaction, not annotation. The redaction must permanently destroy the pixels in the redacted region. SafeRedact's pixel-burn approach rewrites the document so there is no recoverable layer, no metadata, and no OCR text behind the box.
3. Redact the full SSN, not the visible digits. "Show last 4" only works if the underlying text was permanently replaced, not visually covered. If you can copy-paste the digits out of the file after redaction, the redaction failed.
4. Re-export and re-open. Save a fresh copy under a new filename and open it in a different reader. Try to select text in the redacted area. If you get anything, start over.
5. Strip metadata. Author name, last-edited timestamp, and original filename can leak indirectly. Export with metadata removed before sending.

Is it legal to redact a W-2?

Yes. The W-2 is a record about you — your name, your wages, your taxes. Redacting fields on a copy you share for verification is legal and increasingly expected. Verifiers who ask for a "full unredacted W-2" are asking for more than they need; in most cases the conversation ends with them accepting the redacted version once you point out which boxes are still visible.

What is not legal: altering income figures, changing the employer name, or modifying the tax year. Redaction hides information that's there. Falsification changes information that's there. They are different acts with different legal consequences.

If a verifier insists on the full document

Some still will. Before you send the raw file:

• Ask what specific field they need that's currently redacted, and why.
• Offer alternatives: a recent pay stub, an offer letter, an employment-verification letter from HR, or an IRS Wage and Income Transcript (which omits identifiers a W-2 includes).
• If they still require the unredacted W-2, send it through an end-to-end-encrypted channel — not email, not SMS, not a portal you don't recognize. Confirm receipt and ask them to delete the copy when verification is complete.

And if your SSN is ever exposed by a breach or a phishing campaign aimed at your employer, enroll in the IRS Identity Protection PIN program before the next filing season. It blocks anyone without your PIN from filing a return in your name — and the IRS has been pushing universal enrollment since 2024.