Cover or pixelate part of a photo

When you select Save the covered photo, the tool draws a new picture at the full size of your photo and paints each box into it. Then it writes that picture to a new file. The new file holds one flat picture, the pixels that you see, and a color profile where the browser writes one. The boxes are part of that picture, and the history of the file starts with this save.

Two more things happen on the way:

• The metadata is left behind. The new file carries no location, no date, and no camera data. The tool reads the saved file back and offers the download only when that check finds no metadata in it.
• The photo is stored upright. A phone often stores a picture sideways with a note that says "turn me". The new picture is turned for real, so it needs no such note.

Your original stays as it is. The tool works on a copy in the memory of the browser, and the download gets a new name: IMG_1234.jpg becomes IMG_1234-redacted.jpg. If the name of the file says something that the picture now hides, rename the copy before you send it.

Pixelation cuts an area into squares and gives each square the average color of the pixels that were in it. Blur mixes each pixel with its neighbors. Both look like fog to a person. To a program they are arithmetic, and the same input always gives the same output.

That is the weak point for text. Letters and digits come from a small set, in a font that the rest of the screenshot often shows. A program can type a guess in that font, pixelate it the same way, and compare the squares with the squares in your picture. It repeats that one character at a time until the squares match.

This is a tested method. In 2016, four researchers recovered text from mosaiced and blurred pictures with statistical models and concluded that the two transforms "are not viable approaches for text redaction" (Hill, Zhou, Saul, and Shacham, Proceedings on Privacy Enhancing Technologies). In 2022 the security firm Bishop Fox published a tool that reads pixelated text and gave this advice: "When you need to redact text, use black bars covering the whole text. Never use anything else." (Bishop Fox, about its tool Unredacter).

A solid cover has no such trace. The tool paints every pixel in the box the same black, whatever was under it. A box over the digits 4821 and a box over the digits 9073 give the same black pixels, so the black pixels say nothing about the digits.

Use the solid cover for

• License plates, house numbers, and street names.
• Names, phone numbers, email addresses, and account numbers in a screenshot.
• Addresses and reference numbers on a letter, a label, or a ticket.
• Barcodes and QR codes.
• A face of a person who must stay unknown.

What pixelate is fine for

Pixelate is for the cases where you want a part of the picture to be quiet and nobody will work to get it back: a stranger who walked through your holiday photo, a messy shelf behind you, a screen in the background, a logo on a shirt. The picture keeps its colors and its shape, and it looks softer than a black bar.

The pixelate of this tool is coarse on purpose. It uses at most four squares across the short side of a box, and no square is smaller than 16 pixels of the photo. A line of text in a low box ends up as a few blocks of color. For text, the solid cover is still the right choice, and the tool keeps it as the default.

A cover can also fail in simple ways: it is too small, or the same fact is in the picture twice. Look at the photo once more with these in mind:

• Draw the box a little larger than the text. The tails of letters such as g and y and the top of a capital letter stick out. In a JPEG, the pixels right at the edge of a box can also differ a little from pure black, because JPEG stores a picture in small blocks and mixes each pixel with its neighbors. A margin makes both harmless.
• Look for the same thing a second time. A name in the title bar and again in the message. A plate on the front of the car and again in the reflection of a shop window. An address on the letter and again on the envelope behind it.
• Read the edges of a screenshot. The status bar, the tabs of the browser, the address bar, and the notification that slid in at the top all tell something.
• Cover the whole of it. The length of a covered word and the first letter you left out are hints. Cover the full line when the line is the secret.
• Open the saved file and look at it. You send the copy, so check the copy.

Each box can be moved, resized by a corner, and deleted. With a keyboard, Add a box puts a box in the middle of the photo: the arrow keys move it, Shift with the arrow keys resizes it, and Delete removes it.

PNG

A PNG stays a PNG. That suits screenshots: PNG stores every pixel exactly, so the text around your boxes stays sharp and every pixel in a solid box is black.

JPEG

A JPEG is saved as a new JPEG of high quality (95 of 100), at the full size of the photo.

WebP

A WebP photo is saved as a JPEG of the same high quality. A see-through area becomes white.

HEIC

HEIC opens where the browser can show HEIC, as Safari does on an iPhone, an iPad, and a Mac. The covered photo is saved as a JPEG. In another browser, the page tells you that it cannot open the picture.

The saved picture has the same width and height as your photo. One case is different: a very large photo on a device whose browser cannot make a picture of that size. The tool finds that out when you open the photo and tells you before you save. The saved picture then has at most 16,777,216 pixels, about 16.8 megapixels, and the note shows its exact size.

Unlike the two metadata tools on this site, which leave the picture data untouched, the redactor has to make a new picture: changing pixels is its job. For a photo saved as a JPEG, that is one more round of compression, at a quality of 95 of 100. For a screenshot saved as PNG there is none.

The fast way on a phone is to scribble over a name with the marker of the screenshot editor. It works when the stroke is fully opaque. The drawing tools of the iPhone's Markup have an opacity setting, and Apple's guide Use Markup on your iPhone shows where it is: tap the selected tool again. A stroke with less than full opacity is a tinted window. The text under it is darker, and it is still there. Raising the brightness and the contrast of the picture can bring it back.

The highlighter is the usual trap, because its job is to let text show through. In 2018, 9to5Mac showed that text under coats of the Markup marker came back when the picture was lightened in a photo editor.

The solid cover of this tool has no opacity setting. A box is black, and the pixels under it are replaced. On an iPhone, open this page in Safari, choose the screenshot, drag a box over each part with a finger, and save.

A crop hides things too, and it changes the shape of the picture. Use the crop of your phone for what sits at the edge, and a box for what sits in the middle.

The photo that you want to redact is, by its nature, one that holds something private. So the tool runs in your browser, on your own phone or computer. The browser opens the photo, the boxes are painted in the memory of the browser, and the download is saved from there to your device.

To see that for yourself on a computer:

1. Open the developer tools of the browser and select the Network panel.
2. Choose a photo, draw a box, and save.
3. Read the list of requests. The page's own files come down from milkglass.app, among them the tool's program, a file that ends in .wasm.
4. Look for a request that carries your photo up. A photo has several megabytes, so it would stand out. The list has none.

One more address is in the list: ingest.postdeploy.dev. It counts page views, and it counts that the tool was used. The count names the tool and holds nothing about the photo: no name, no size, no content, and nothing about your boxes. Open the request and read what it sends.

The site's content security policy names milkglass.app and that one counting address, and the browser blocks a connection to every other origin.

A covered copy is for sharing. For the photos you keep to yourself, I make Milkglass, an app that keeps them in Drawers on your iPhone. More about it is at the end of this page.

• View and remove photo metadata lists what it finds in a photo file and removes it. A block that it cannot read is removed whole, and the picture data stays byte for byte.
• Remove the location from a photo takes out the GPS position and the place names and keeps the date and the camera.