Blur or Pixelate an Image

The important property of a redaction tool is that it actually destroys the pixels. Drawing a black rectangle over something in a document editor famously does not — the content sits underneath, recoverable by anyone who copies it — and governments, law firms and newspapers have all published documents that way. The same mistake is easy to make with images by compositing an overlay and calling it done. Here the pixels are read, replaced and written back, so the originals are gone from the file rather than hidden behind something.

The three options are not equally safe, and the tool says which is which rather than leaving you to assume. A solid block is irreversible: the values are replaced with a flat colour and nothing survives. Pixelation is strong provided the blocks are coarse — fine pixelation of text has been reversed by rendering candidate strings and comparing them against the output, so use larger blocks than feel necessary. Blur is the weakest: a mild blur is in principle invertible and has been reversed on real images. Use it for aesthetics, not for anything that matters.

The output is PNG rather than JPEG deliberately. Lossy compression works by discarding detail in a way that depends on the surrounding pixels, and a redacted region in a lossy file can in principle carry traces of what the encoder saw. PNG is lossless, so what you see is exactly what is stored.

One thing this cannot remove: metadata. A photo also carries the camera, the timestamp and often the GPS coordinates, none of which are visible in the picture. Blurring a face and leaving the coordinates of where it was taken is a common and self-defeating mistake — the EXIF tool handles that half.

All of it runs in your browser. Uploading an image to a stranger's server in order to hide something in it would rather defeat the purpose.