Tooltrusty

Privacy Blur Tool

Redact part of a picture — on a page that never sees the picture.

Drop an image here or click to choose a file — the image you need to redact

Runs in your browser. This tool exists because of where it runs. The image you need to redact is, by definition, the one you cannot afford to upload — and it never is. It is read from disk by your browser, drawn to a canvas, redacted, and re-encoded locally. The unredacted version never leaves your device.

What the privacy Blur Tool does

Redaction is the one image task where the tool's own architecture matters more than its features. The picture you need to blur is a screenshot with a customer's details in it, a photograph with a child's face, or a document with an account number — exactly the file you should not upload to a stranger's server in order to make it safe. This tool reads the file locally and never transmits it.

Drag a rectangle over anything you want removed. Add as many regions as you need, undo the last one, or clear them all. Three methods are offered, and the differences between them are not cosmetic.

Solid block replaces the region with flat colour. The original pixels are overwritten and the information is destroyed. This is the only method that is genuinely irreversible, and it is the one to use for anything that matters.

Pixelation and blur look more elegant and are considerably less safe. Both are deterministic transformations: given the pixelated output, an attacker can generate candidate inputs, run them through the same filter, and compare. Researchers have recovered pixelated text this way, and the technique works particularly well on things with limited possible values — a licence plate, a six-digit code, a name from a known list. Blur is somewhat better than pixelation but is not a guarantee.

Whichever method you pick, the download is a flattened PNG. There is no layer to peel back and no hidden original inside the file — unlike redacting in a PDF or an office document, where the covered content is notoriously often still present underneath.

How to use it

  1. Load the image you need to redact. It stays on your device throughout.
  2. Drag a rectangle over each face, plate, address or account number.
  3. Choose Solid block for anything sensitive. Use blur or pixelate only when appearance matters more than security.
  4. Download. The output is flattened at full resolution with the original pixels gone.

A worked example

A support screenshot containing a customer's email address, order number and postcode, being prepared for a public bug report:

  1. Load the screenshot. Nothing is uploaded, which matters because it currently contains all three pieces of personal data.
  2. Set the method to Solid block.
  3. Drag over each of the three fields. The counter shows three regions.
  4. Download. The PNG that lands in your downloads folder has black rectangles where the data was, and no copy of the original pixels anywhere in the file.

Had you pixelated the order number instead, someone could plausibly recover it: order numbers follow a known format, so an attacker can generate every candidate, pixelate each one at the same block size, and look for the match. That attack takes minutes and is the reason the solid block is the default here.

Frequently asked questions

Is blurring enough to hide a face or a number plate?

Often not. Blur and pixelation are reversible transformations, and recovery attacks work especially well where the possible inputs are limited — plates, postcodes, short numbers. Use a solid block for anything you genuinely need hidden.

Why is a solid block safer?

Because it destroys the information rather than transforming it. There is nothing left to reverse: the pixels underneath are overwritten with flat colour before the file is written.

Can the original be recovered from the downloaded file?

No. The download is a flattened PNG built from a canvas that already had the redaction applied. There are no layers and no embedded original. This is a real advantage over redacting inside a PDF or a word processor, where the covered content frequently survives underneath the black box.

Does this remove metadata as well?

Yes, as a side effect. Re-encoding through a canvas discards EXIF, including GPS coordinates. If you want to check what a photo was carrying before you redact it, look at it in the EXIF Viewer first.