Blur, Pixelate, or Black Box? Choosing a Redaction Method
Every redaction is a bet that nobody can reconstruct what you covered. Blur, pixelation and a solid block look similar in a thumbnail, but they destroy very different amounts of information. The Privacy Blur tool offers all three, and picking the right one matters more than picking a high intensity value. If you want the click-by-click walkthrough instead, read How to Blur Faces, Text and Sensitive Info in Photos.
The three modes are not equally strong
Think of each mode as a filter applied to the pixels inside your selection. What matters is how much of the original signal survives that filter.
Classic blur is a Gaussian convolution. Each output pixel is a weighted average of its neighbours, so the original values are smeared rather than deleted. Blur is mathematically a linear operation, which is exactly why deconvolution exists: if the radius is small and the image is clean, some of the underlying structure can be estimated back out. A light blur over a licence plate is closer to a soft focus effect than to redaction.
Pixelation replaces each block with the average colour of that block. It looks aggressive, but the operation is deterministic and public. Anyone who knows the block grid can take a guess at the hidden content, render that guess in the same font at the same size, pixelate it with the same settings, and compare the result against your image. Match the mosaic and you have recovered the text. Researchers in the mosaic de-identification field have demonstrated this class of attack against both pixelated faces drawn from a known set of people and pixelated screenshots of monospaced text, where the candidate space is small and the rendering is easy to reproduce.
Solid block throws the pixels away and paints a flat colour. There is no residual signal, no averaging, nothing to invert. It is ugly, and it is the only one of the three that is unconditionally safe.
| Mode | What survives | Best for |
|---|---|---|
| Classic blur | Smeared but recoverable structure at low radius | Faces of bystanders, general scene softening |
| Pixelate | Block averages that can be matched against guesses | Aesthetic censoring where content is not guessable |
| Solid block | Nothing | Card numbers, addresses, IDs, anything short and guessable |
Guessable content is the real risk factor
The attacks above only work when the attacker can narrow down what was hidden. A sixteen digit card number, a house number, a six character order ID, a date of birth, or a name from a known mailing list are all tiny search spaces. An arbitrary photograph of a stranger's living room is not. So the practical rule is simple: the shorter and more predictable the hidden value, the harder your redaction needs to be. For anything you would call a secret, use the solid block mode and stop worrying about it.
Cover generously. Redaction boxes that hug the text leak information through outline shape and length. Extend the selection past the ascenders, descenders and both ends of the string so the width of the covered region does not reveal the number of characters.
Redaction is only as good as the file you share
A surprising number of leaks are not failures of the blur itself but of the container around it. Layered editor files keep the original pixels under the redaction layer. Some built-in screenshot croppers have historically written the cropped image into the file without truncating the original data, which meant the untouched pixels were still recoverable from the saved image. Exporting a flattened raster file is what makes a redaction permanent, and that is what the tool's download button produces: a fresh canvas where the covered pixels no longer exist.
Because every step runs in your browser, the picture you are redacting is never uploaded anywhere. That matters here more than for most tools, since the whole point of the operation is that the sensitive original should not travel.
Things a blur does not hide
- Metadata. Covering a face does nothing to the GPS coordinates, timestamp and camera serial stored in the file. Run the image through the Metadata tool as a second pass, and see what EXIF actually reveals for the full list.
- Context. Tattoos, jewellery, a lanyard, a distinctive jacket, a house number in the background, or a reflection in a window can identify a person just as well as their face.
- Text you forgot. Screenshots often carry a browser tab title, a notification banner or an autofill dropdown. Scan the whole frame, not just the obvious field. If the screenshot is dense, running it through OCR first is a quick way to list every string the image contains before you decide what to cover.
Working faster without cutting corners
For photos with several people in them, the automatic face detection button loads a small in-browser detection model and places boxes over the faces it finds. Treat it as a first pass rather than a final answer: it can miss profiles, partially occluded faces and anyone facing away, so always check the result and draw the remaining boxes by hand. The intensity slider controls the blur radius or the pixel block size depending on the active mode, and the undo button steps back one box at a time if you overshoot.