Hiding a Face, a Plate or an IBAN in an Image — Permanently

Does it destroy the pixels, or draw over them?

This is the only question that matters, and it is the one most tools never answer. A redaction drawn as a separate layer — a shape in a PDF, an object in a design file, an annotation in a photo app — leaves the original underneath, and the original comes back the moment someone opens the file in a program that understands layers. It has happened to court filings, to government reports and to at least one bank statement posted online. So the first thing to establish is whether the black rectangle is part of the picture or sitting on top of it.

Here the answer is clean. Both modes operate on the raw pixel array of an HTML canvas: the solid mode fills a rectangle straight into the bitmap, and the average-colour mode reads the region out, works one colour out of it, and paints that single colour back across the whole rectangle. There is no layer, because a canvas has no layers — it is one grid of pixels and nothing else. The download is produced from that grid as a PNG, and when we inspected the exported bytes the file held exactly four chunks: the header, two blocks of compressed image data, and the end marker. No metadata, no embedded preview, no second copy of anything. Whatever was under the rectangle is not in the file.

Destroyed is not the same as unrecoverable

This is where most explanations stop, and where the real risk starts. Pixelation and blur both throw information away — that part is true. But both are deterministic: feed the same picture in and you get the same output out, every time, with no randomness anywhere. That turns hiding into a puzzle with a checkable answer. If an attacker can guess what was under the rectangle, they can produce their guess, run it through the identical transform, and see whether the result matches what you published. When the set of possible values is small — a licence plate, a date of birth, a four-digit code, an amount, a name from a known list — the whole set can simply be tried.

So we tried it on this tool, back when it still offered both. We built a small region of a document — 120 pixels by 44, holding four digits, the kind of thing you would censor at the end of an account number — and censored it with the tool's own code. Then we rendered all ten thousand four-digit strings, put each candidate through the identical censor at the identical setting, and ranked them by how closely they matched. This is not a clever attack. It is the most obvious one there is, it needs no machine learning and no special hardware, and it ran inside an ordinary browser tab.

The results are in the table below, and they were unambiguous. Pixelation at the strongest setting the tool offered handed back the true digits at rank one out of ten thousand, with an error of exactly zero and a single candidate matching, in under two seconds. Blur at its strongest setting did the same, more slowly, in forty. The solid rectangle behaved completely differently: all ten thousand candidates produced identical output, tied at zero error, and the true value ranked four thousand four hundred and seventy-second — which is to say, nowhere, because there was nothing to rank on. That is not the black bar being better by a margin. It is the black bar being in a different category: there is no information left to attack, so no amount of computing power changes the result. Turning the intensity up made no difference either, because the strength of the effect was never what mattered — what mattered was that the effect left the region's layout intact. That is why neither mode is offered here any more.

What replaced them, and what it still gives away

Two modes remain. The solid fill paints the rectangle in a colour you choose, and it is the one to reach for whenever the hidden thing is short and guessable. The other replaces the region with a single flat colour worked out from the region itself — its own average — so it reads as softened rather than as a hard black bar, which is what most people wanted from blur in the first place. Both destroy every trace of the region's layout, and we checked that rather than assuming it: reading the pixels back at every position of the edge slider, the whole rectangle holds one value, to the byte, in all four channels. Nothing inside it varies from place to place, so there is nothing left for a candidate to match against.

The average-colour mode does still give away one number, and it is worth knowing exactly how much. That number is the region's mean tint — roughly how much ink the area held. Running the same ten-thousand-candidate attack against it, the four-digit codes collapsed into only twenty-four distinct average colours, and the true value came out inside a tie of two hundred and forty-six, identically, at every setting of the edge slider. That narrows ten thousand possibilities to a couple of hundred; it never picks one out. Two of the ten thousand are unlucky: 0000 carries more ink than any other combination and 7777 less, so each of those owns its average colour alone and would be handed straight back. The solid fill has none of this, because the colour you pick has nothing to do with what was underneath. For a code, a date of birth or an IBAN, use it.

How to redact so that it stays redacted

Prefer the solid fill, and treat anything that still resembles the original as a warning sign. The independent research points the same way: the security firm Bishop Fox, which built a tool that reconstructs pixelated text, concludes that opaque bars are the only acceptable method and names blurring, fuzzing and swirling alongside pixelation as things to avoid. Our own measurements reached the identical conclusion from the other direction, which is why two of this tool's three modes no longer exist. If it looks like the original in any way at all, it is carrying information about the original — and that holds in every editor you will ever open, not only in this one.

Two habits make the rest of it safe. Draw the rectangle larger than the thing you are hiding — an edge that clips a digit in half still shows the top of that digit, and the outline of a jaw is enough to narrow a face. And check the downloaded file rather than the editing view: open the exported image at full size and zoom into the rectangle. If you can see any structure at all inside it — banding, a ghost of an edge, blocks of slightly different grey — the redaction did not take. A solid fill zoomed to 800 percent is one flat colour, and that flatness is the thing you are verifying.

Frequently asked questions

Is blurring ever good enough?

Not for anything you would call redaction, which is why this tool no longer offers it. Blur is a linear, deterministic operation, so an attacker who can guess the content can blur their guess the same way and check. In our test the strongest blur the tool used to offer gave the hidden digits back exactly, first out of ten thousand candidates, in forty seconds. Blur is a reasonable aesthetic choice for a background you are not trying to conceal; it is not a way to hide a value that matters — here or in any other editor.

If pixelation throws information away, how can it be reversed?

It is not reversed by undoing the maths — that really is impossible. It is reversed by guessing forwards. The attacker never inverts anything: they produce a candidate, apply the same pixelation, and compare. Information is only lost in the sense that many originals map to the same output; when the plausible originals number in the thousands rather than the billions, almost always exactly one of them matches. A four-digit code has ten thousand possibilities. A date of birth has a few tens of thousands. Those are not large numbers for a computer.

Can I censor two things in the same image?

Yes — censor as many regions as you like, one after another, and every one of them survives into the download. It was not always so. The tool used to redraw the untouched original before each censor, quietly undoing the previous one, and we confirmed it by censoring two regions in turn and reading the pixels back: the first had returned to its original colour. That is fixed. Censors now accumulate on a single working bitmap, the selection rectangle you drag is drawn onto a copy so it cannot disturb them, and the file you download is that bitmap — without the pink outline.

Does the downloaded file still contain the original underneath?

No. The export is a PNG written from the canvas pixel grid, and when we read the exported bytes it held only the image header, the compressed pixel data and the end marker — no metadata block, no embedded preview, no second image. This also means the tool drops anything the source file was carrying: a photo's location data, timestamp and camera details do not survive into the censored copy. That is a side benefit rather than the point, and it is worth confirming rather than assuming if the original is sensitive for reasons beyond the rectangle.

What about video — is a pixelated face in a clip any safer?

It is usually worse, not better. A still image gives an attacker one measurement of each block; a video gives one per frame, and if the camera or the subject moves at all, the block grid slides across the content and each frame samples it slightly differently. Researchers at Positive Security demonstrated exactly this, stabilising a clip so the redacted area sat still and stacking the frames to pull back a licence plate and a bank form. If you must redact in video, cover the region with an opaque shape on every frame, and check the frames around cuts and camera moves.