Blur Face & Censor

A black rectangle drawn over a face in a layered editing file is not redaction — it is a sticker, and anyone who opens the original file can move it. Even flattened, a solid box announces that something was hidden and invites the question of what.

Blurring works differently. It destroys the information in place: the pixels are replaced by an average of their neighbours, and the detail that made the face recognisable no longer exists anywhere in the file. Export it and there is nothing to recover, because nothing was preserved.

That is the property you actually want from redaction. Not concealment, which can be undone, but destruction, which cannot.

Pixelation replaces regions with large blocks of a single averaged colour. It looks decisive, and for that reason it is the convention in television and journalism, where the audience is meant to understand that something has been withheld.

For genuine anonymisation it is the weaker option. The block averages retain structure — the rough position of eyes, the shape of a jaw, the contrast between hair and skin — and researchers have demonstrated recovering identities from pixelated faces where the block size was not aggressive enough. A strong Gaussian blur leaves considerably less signal behind.

Use pixelation when you want the redaction to be visually obvious, and blur when you want the person to be genuinely unidentifiable. If you need both, pixelate heavily rather than lightly.

The most common mistake is blurring too tightly. A region covering only the eyes leaves the jawline, hairline, ears and skin tone intact, and people are recognised by all of those. Cover the whole head, and extend slightly past the hairline.

The second mistake is blurring too weakly. Judge the result at full zoom rather than at the thumbnail size, because a blur that looks sufficient in a small preview often is not. If you can still tell who it is, so can anyone who knows them.

Remember the rest of the frame too. Name badges, house numbers, licence plates, reflections in windows and the text on a screen behind the subject all identify people, and a photo with a perfectly blurred face and a visible street sign has not achieved much.

Under GDPR and similar regimes a recognisable face is personal data, and publishing it generally needs a lawful basis — consent being the usual one. That obligation applies to organisations far more heavily than to individuals posting holiday photos, but it is real.

The situations where it bites hardest are predictable: photographs including children, images from schools, clinics and care settings, crowd shots used commercially, workplace photography, and anything showing people who did not know they were being photographed. Blurring faces is the cheapest way to remove the question entirely.

Because everything here runs in your browser, the unredacted original never leaves your device — which is the correct handling for exactly this class of image.