Blur a face or black out text in a photo, permanently

Why a black box in a document is not a redaction

The most-repeated failure in this whole subject is not technical. Somebody opens a PDF, a slide deck or a screenshot, draws a black rectangle over a name, saves, and publishes. The rectangle is an object sitting on a layer above the content. The content is still in the file. Selecting the rectangle and pressing delete brings the name back, and so does copying the text out, and so does opening the file in almost any editor.

Law firms have filed it. Government departments have published it. A newspaper has done it with a passport. The pattern is always the same, because the tool that drew the box did exactly what it was asked to do and nothing in the interface suggested that the original was still there.

The same applies to a blur used as an adjustment layer in an image editor: the layer is non-destructive by design, which is the feature, and the original pixels sit underneath it in the saved project file. Exporting a flattened copy fixes it; sending the project file does not.

This tool has no layers. The region you draw is written into the pixel buffer — the pixels are replaced, not covered — and the file is then encoded from that buffer. What comes out is a new image in which the covered area contains a flat colour or an average, and there is nothing else in the file. That is also why the output is re-encoded rather than patched: a redaction that preserves the original compressed data is not a redaction.

Which covering to use, and when a blur is not enough

A blur is an averaging operation. Average the same pixels a second time and you have lost information, but not necessarily enough information: if what was blurred came from a small, known set — the digits nought to nine, a licence plate alphabet, a fixed-width font rendering a bank balance — then an attacker can blur every candidate the same way and compare. That attack has been demonstrated repeatedly on mildly pixelated text and on faces blurred at small radii, and it is the reason "we blurred it" is not by itself a claim worth making.

This tool destroys the region before it blurs it. Both the pixelate and the blur modes first average each cell down to a single colour, so the fine structure the attack depends on is gone before the smoothing pass ever runs, and the cell size is proportional to the region rather than fixed at some small default. That makes the result genuinely irreversible. It does not make it invisible: a pixelated face still shows a head-shaped arrangement of skin tones, and that is sometimes enough to say who was standing where.

When the point is that something has been removed and nothing about it should survive, use the solid block. It is the only mode that tells the viewer honestly that a decision was made, and it is the only one with no residue at all.

There is no face-detection service behind this page

Automatic face detection on a web page has exactly two implementations. One sends your photograph to a server that runs a model — which is what the majority of "free online face blur" sites do, and it is the opposite of what you came here for. The other downloads a model into the browser, which on a modern detector means several megabytes over a phone connection before the page can do anything.

This page does neither. Where the browser exposes the experimental Shape Detection API — Chrome on Android, and behind a flag on some desktop builds — the Scan button uses it and the result is labelled a suggestion. Everywhere else the button is not shown, because a button that quietly does nothing is worse than no button.

Drawing the areas by hand takes about five seconds per face and has a property no detector has: you looked at the picture. A detector finds frontal faces. It does not find the person in profile at the edge of the frame, the child reflected in a window, the face on a poster, the name on a lanyard, or the street sign that places the whole photograph.

What else in the frame identifies somebody

A box over a face is the beginning of the job rather than the end of it. Before publishing a photograph in which somebody should not be identifiable, it is worth going through the frame once more for the things that are not faces:

• Name badges, lanyards, ID cards, and the reverse of a card visible through a lanyard sleeve.
• Screens — a laptop, a phone, a monitor in the background — which frequently show an email client.
• Reflections in windows, mirrors, kettles, spectacles and polished tables.
• House numbers, street signs, shop fronts, bus route numbers, and the view from a window.
• Vehicle registration plates, including partial ones, and distinctive vehicles.
• Tattoos, scars and jewellery, which are identifying and are rarely thought of as such.
• Documents, envelopes, prescriptions and delivery labels lying on a surface.
• Uniforms and badges that narrow a person to one workplace on one shift.

And then the part that is not in the frame at all: the file's metadata. A photograph with every face covered can still carry the coordinates where it was taken and the serial number of the camera that took it. This tool removes all of that as a side effect, because the output is encoded from pixels — the metadata tool is where to look if you want to see what was in there before it goes.

Screenshots are the commonest case

Most files that pass through a redactor are not photographs of people. They are screenshots: a bank statement for a dispute, a message thread as evidence, a bug report with a customer's details on screen, an invoice for an expense claim. Screenshots carry a specific set of things people forget.

The status bar is the first. Carrier name, signal strength, battery percentage and the exact clock time are all in the top few pixels, and together they narrow a person and a moment. The second is the browser chrome: a URL with a session token in it, an open tab list that describes a whole afternoon, an autocomplete dropdown, a bookmark bar with a company's internal tools on it. The third is the surrounding interface: a sidebar of contact names, a notification, an account switcher showing a personal address next to a work one.

Cover all of it, and use PNG as the output format for anything with text in it. JPEG compresses text edges badly and a redacted screenshot that is hard to read is a redacted screenshot that gets sent again unredacted.

What happens to the file, step by step

The image is decoded by the browser, with its EXIF rotation applied to the pixels so that what you see on screen is what gets exported. Drawing a region records a rectangle in image coordinates, not screen coordinates, so the covering lands in the right place regardless of how the preview is scaled to your window. Applying redraws the picture at full resolution, replaces each region's pixels, and encodes the result.

Nothing is uploaded at any point, and there is no request the page could make: the modules under /js/tools/ contain no networking code at all. Once the page has loaded you can disconnect the network entirely and every part of this still works, which is the version of that claim you can verify rather than take on trust.

If a photograph is sensitive enough to be redacted before it is sent, it is usually sensitive enough not to live in the camera roll in the first place. That is what the vault is for — files encrypted on the device, outside the Photos library — and the encryption page states every parameter rather than calling it military-grade.