How to redact faces and personal data before posting

The person in the center is the easy decision. You either have their agreement or you are about to ask. The leaks are the people who did not know they were in the photo: a child at the edge of a group, a stranger in a café, a coworker on a video call that was open on the laptop, a reflection in a window or in sunglasses. If you would not tag them, do not leave them recognizable.

Personal data in a photo is not only a face. A name tag at a conference, a student ID on a lanyard, a jersey with a surname, a Slack sidebar on a monitor, and a delivery label on a package are all names. A license plate and a house number are locations. A school name on a sweatshirt plus a face is enough for a stranger to narrow a child down. Treat those as part of the same pass, not as a second project you will do later.

This editor will not scan the photo and propose boxes. That is deliberate. You drag rectangles, choose blur, pixelate, or black box, and export a PNG. The file is processed in your browser and is not uploaded for editing. You are slower than an automatic detector, and you are also the only one who knows which person is the subject and which person is an accident.

A thin blur across the eyes is a costume. Friends will still know the person, and a stranger with a little context — the event, the office, the team photo — often will too. Draw from above the hair to below the chin, and wide enough for the ears. If a hat or a hood is distinctive and the face is the problem, the hat can stay; if the hat is how you recognize them in that group, include it. Glasses that are unique to one person in the room should be inside the box.

Pixelate is usually the clearer choice for a face you are publishing, because viewers can see that the cover was intentional. Make the blocks large enough that an eye does not survive inside one block. Blur works when the strength is high and the result is a smear rather than a soft portrait. The homepage editor starts on blur. Switch to pixelate before you draw the face, or undo and redraw after you change mode. The mode applies to the next box.

Do a second lap for people you were not thinking about. The arms-length photo of a dinner has a server behind the table. The conference photo has a badge in the row behind. The screenshot of a video call has five other tiles. Each of those is a separate drag. Undo removes the last box only, so work one person at a time and check as you go.

A blurred face with a readable name is not anonymized. Cover the name with a black box even when the face is pixelated. That includes the lower third of a video tile, the embroidered name on a shirt, the byline on a slide, and the contact card open on a phone in someone’s hand. Generic words can stay. “Volunteer” is different from a surname.

Screens in the background are documents. A laptop on a café table shows a calendar titled with a patient’s name, a spreadsheet of emails, or a chat. If the screen is large enough to read, it is part of the photo. Black box the readable region. If the screen is only a glow and you cannot read it even when zoomed, you can leave it or soften it with blur so it does not become readable on a larger display.

Children deserve a stricter pass than coworkers who expect to appear in a work post. If you are not the parent making that decision, do not post an identifiable child because they happened to be in the frame. Cover the face fully. Cover the name on the artwork, the school logo if it combines with other clues, and the address on the drawing they are holding. When in doubt, crop them out of the frame entirely. A crop removes the question.

A plate number is only part of what a listing or a street photo gives away. The region code, a dealer frame, and a sticker can narrow a car after the digits are gone. Draw over the whole plate. Then look at the bumper and the glass. If two cars are in the frame, do both, including a reflection in a shop window. Black box is the clearer cover when nobody should read characters. Pixelate is reasonable when the blocks are large and the photo still needs to look like a car.

House numbers, apartment directories, and a school name on a building do the same job as a plate. If the post is “the door I painted” and the number is sharp, you published an address. Cover the number. You do not have to black out the entire street if the rest of the facade is not unique, but be honest about unique murals, a business name, and a unit letter.

Badges combine the problems. The portrait is a face. The printed line is a name. The logo may be an employer you did not mean to advertise, which is a separate choice. Pixelate or strongly blur the portrait. Black box the name. Leave the lanyard if it is not the point. A QR code on a badge or a ticket should be blacked out, not blurred, because a partial pattern can still be a code.

Download is the export this site offers. The file is named redacted-image.png. Your camera file stays where it was, with its metadata. Attach or upload the PNG. In a phone share sheet, the recent item is often the original screenshot or photo, not the file you just made. Check the name and, if you can, the preview at a size where text is sharp.

Say what you removed only if the audience needs it. “Faces in the background are covered” is enough. Do not add the names in the caption in order to be polite. The caption is part of the post. A black box with the name written underneath is a labeled portrait.

If the photo is going to a group chat, a marketplace listing, a school newsletter, or a public profile, assume it will be saved by someone else. You will not get every copy back. The pass above is the whole job: faces, names, plates, numbers, screens, then one slow look at the file you are about to send. Paste the photo into the editor on the homepage when you are ready. Nothing in that step uploads it.