How pixelation works, and why that matters
The image is divided into square blocks, and every pixel in a block is replaced by that block's average colour. The original values are discarded rather than hidden, which is what makes it suitable for redaction — unlike a shape drawn on top in a layered file, where the content underneath can survive.
The [msm_tool slug="pixelate-image"] applies it to the whole image or to a region you specify. The region case is the usual one: a number plate, a name on a document, a face in the background.
Small blocks are not redaction
This is the part worth taking seriously.
Because each block is an average of what was there, the block values still carry a trace of the original pattern. For text in particular, that trace can be enough to work backwards from: generate candidate strings, pixelate each one with the same block size, and compare against the target. Against a known font and a limited character set — a postcode, a licence plate, a reference number — this works better than most people expect.
The defence is block size. Use blocks large enough that the region reads as flat colour with no internal structure. If you can still make out how many words were there, or where the letters started and stopped, the blocks are too small.
Or use a solid block
Where certainty matters more than appearance, a solid block replaces the pixels entirely and there is nothing left to reconstruct from. It is less elegant and it is unambiguous.
Pixelation is the better choice when it should be visible that something was removed rather than never present, and when the image should still look like a photograph. Those are real reasons; they are just not security reasons.
Cover more than you think
A partly obscured face or plate is frequently identifiable from what remains — a hairline, a jaw, two visible characters. Each fragment narrows the field considerably, and a determined person is working with all of them at once.
Extend the region well past the edges of the subject. Covering too much costs you a slightly larger grey rectangle. Covering too little costs you the entire point of the exercise.
Check the rest of the frame
Redaction is a property of the whole image, not of the region you treated.
- A reflection in a window, a screen or glasses.
- The same document or name visible a second time elsewhere.
- A monitor in the background displaying what you covered in the foreground.
- Surroundings distinctive enough to identify a place as precisely as an address.
Look at the finished image the way a stranger would before deciding it is done.
Metadata survives untouched
Pixelating a face does not remove the GPS coordinates the photograph was taken with, nor the timestamp, nor the device model. Those are metadata and nothing you do to the pixels affects them.
If the point is anonymity, strip the metadata as a separate step. Doing one and not the other leaves the more precise identifier in place, which is a common and slightly absurd outcome.
Pixelation as a style
Away from redaction it has legitimate decorative uses — a deliberately low-fidelity thumbnail, a progressive loading placeholder, a retro treatment. For those, small blocks are the point and none of the above applies.
Just be clear with yourself about which job you are doing. The same operation at the same settings is a nice effect in one context and a false sense of security in the other.
A working order for redaction
- Note the region's position and size in a viewer that shows cursor coordinates.
- Choose a block size large enough that no structure remains.
- Extend the region past the subject's edges.
- Scan the whole frame for the same information appearing elsewhere.
- Strip the metadata from the exported file.
- Open the exported file — not the preview — and check it before sending.