Redact image details permanently

Redact image pixels instead of covering them with a layer

A black rectangle can mean two very different things. In an editor it may be a movable shape sitting over an untouched photo. In a flattened raster it is the photo: the covered pixels no longer exist in the exported file. This tool takes the second route. Every marked rectangle is painted into a new full-resolution canvas before PNG or JPEG encoding.

That boundary is why the page does not return an editable design document. Editable layers are useful during review but unsafe as the final redaction artifact. Keep the original separately if policy allows, inspect the flattened download, and share only that new file.

Draw slightly beyond the sensitive detail

Drag across a face, name, serial number, address, screen, license plate or other region, or tap it to drop a square box a tenth of the image's shorter side wide. Tap a box to select it and remove it. The mark list reports each rectangle in source pixels and lets you remove one, undo the last, or clear everything. A tap never becomes a microscopic box that looks complete while leaving the detail exposed: it is always a full-size square you can see in the preview.

Give text and faces a small margin. Anti-aliased letter edges, shadows and reflections can reveal shapes outside a tight rectangle. For a document photograph, cover the whole field label as well as its value when the label itself discloses what kind of information was present.

What opens here, and what to do when a file does not

PNG, JPEG, WebP, AVIF, GIF and BMP open in every current browser. HEIC and TIFF depend on which browser you are using: Safari on a recent Mac or iPhone decodes both through the system, while Chrome, Edge and Firefox decode neither. Rather than publish a format list and turn files away at the door, the page hands every submission to the same decoder and only explains afterwards. An iPhone owner in Safari therefore drops a HEIC straight onto the canvas and never sees a message at all.

When a decode does fail, the reason comes from the file's own leading bytes rather than from its name or the type the operating system guessed, because a renamed file lies about both. A HEIC that this browser cannot read points at HEIC to JPG; a scan points at TIFF to PNG, which is lossless in both directions. A file of zero bytes says so instead of blaming its format, and a file that begins as a valid JPEG but stops partway is reported as truncated, which is a download to repeat rather than a format to convert. Dropping, choosing and pasting the same file all produce the same sentence, since all three routes end at the same decoder.

An SVG is refused on purpose, and the reason is worth stating plainly: it holds shapes and text as editable markup rather than pixels. A black rectangle placed over a name in a vector file sits above that name and the name stays readable in any text editor, which is the exact failure this page exists to prevent. Rasterize it with SVG to PNG and redact the PNG. A GIF is accepted but opens as its first frame only, and the download is a still image; redact the frames you need one at a time.

PNG and JPEG rebuild the entire file

PNG is lossless and keeps screenshot text, interface edges and diagrams crisp. JPEG at high quality usually creates a smaller photograph but recompresses all visible pixels. Neither export copies the original container or attaches a black overlay. The receipt reports the actual new file size and format.

The browser canvas also leaves the original metadata behind. EXIF camera details, GPS coordinates, XMP, embedded thumbnails and provenance blocks are not copied into the new raster. If metadata removal is the only task and visible pixels should remain byte-for-byte as close as the format allows, use the EXIF remover instead; it can preserve orientation explicitly and reports what it found.

Redacting a photo is different from redacting a PDF

A PDF can contain live text, vector paths, annotations, form fields and hidden objects behind what looks like a page. A flattened image has only pixels. Use Redact PDF for a document file because it rebuilds pages and handles the PDF-specific layers. Taking a screenshot and painting over it may be acceptable when the screenshot itself is the intended output, but it is not a safe way to return an editable PDF.

Manual boxes are deliberate, not a missing animation

Automatic face blur is a separate problem. A detector can miss a face turned sideways, small in the background, covered by a mask or rendered on a screen inside the image. It can also mark a portrait, poster or pattern that is not a person. A reliable product must show every proposed region and require review before export.

This page therefore promises only what it can prove: rectangles you draw are opaque in the final raster. It works equally for faces and details that no face model understands, such as parcel labels, medical screens and identification numbers.

When keeping the visual context matters more than opaque removal, Blur faces uses a self-hosted detector for reviewable suggestions and lets you add every missed region before flattening strong pixelation or blur.

Check the downloaded file, not only the preview

Open the PNG or JPEG after download and zoom into every edge. Confirm that the file name ends in -redacted, the black areas are present, and no detail remains in another part of the image. If a platform later crops, enhances or replaces the upload with an original cloud copy, that is outside this file; upload the flattened download intentionally.

Compression can change size without changing the redaction. The image compressor can reduce a final photograph after review, while format tools such as JPG to PNG and PNG to JPG handle a deliberate handoff. Do not compress the source first if it makes small details harder to mark.

The source image stays in this tab

Decoding, preview drawing, rectangle geometry and final encoding happen in browser memory. No source pixels or redaction coordinates are sent to an API. The guide to verifying local processing shows how to confirm that with the Network panel.

Local processing protects the editing step, not the destination. A recipient can still infer context from whatever remains visible, so inspect the full frame rather than only the area that first drew your attention.