Redaction is not a visual effect
Blurring a face or a document to remove information is a security operation, and it fails in ways that look fine on screen.
The [msm_tool slug="blur-region"] obscures a region either by blurring it or by covering it with a solid block, applied to the pixels rather than drawn as a layer on top — so the exported file contains only the obscured result. That part is important, and it is where many other approaches go wrong.
The two methods are not equivalent
A solid block replaces the pixels entirely. The original values are gone, and nothing can recover them. It is certain.
Blurring averages the pixels together. The values change, but the averages still carry structure from the original — and for text in particular, that structure can sometimes be enough to reverse. There is published work reconstructing pixelated and lightly blurred text by generating candidate strings, blurring each one the same way, and comparing. Against a known font and a limited character set it works better than people expect.
So: a solid block where certainty matters. Blur where it should be visible that something was removed and the image should still look natural — and then blur hard.
Blur hard or not at all
A gentle blur over a face or a document is decoration rather than redaction. If the shape of what is underneath is still discernible, it is not strong enough.
The test is simple: if you can tell how many words were there, or where the eyes were, the blur is doing less than it appears to. Increase it until the region reads as a smooth gradient with no internal structure.
Cover more than the subject
A partly obscured face or number plate is frequently identifiable from what remains. Hairline, jaw shape, the two visible characters of a plate — each narrows the field considerably.
Extend the region well past the edges of what you are hiding. The cost of covering too much is a slightly larger grey rectangle; the cost of covering too little is that the redaction did nothing.
Check the whole frame, not the region
This is where redaction most often fails, and it has nothing to do with the blur strength.
- A reflection in a window, a screen or a pair of glasses.
- The same document visible a second time elsewhere in the image.
- A name badge, a lanyard, a signature further down the page.
- A monitor in the background showing the thing you redacted in the foreground.
- Distinctive surroundings that identify a location as well as an address would.
Redaction is a property of the whole image. Look at it as a stranger would before deciding it is done.
Metadata is separate and survives
Blurring a face does not remove the GPS coordinates the photograph was taken with, nor the timestamp, nor the device. Those are metadata and are untouched by anything you do to the pixels.
If the point of redacting is anonymity, strip the metadata as well. Doing one and not the other is common and leaves the more precise identifier in place.
Why layers on top do not count
Drawing a black rectangle over text in a PDF or a design file frequently leaves the text underneath, retrievable by selecting it or by opening the file in another tool. This has caused a long series of public embarrassments involving court filings and government documents.
Applying the change to the pixels and exporting a flat image avoids that class of failure entirely, which is the reason to do it here rather than by drawing a shape in an editor and saving the layered file.
A working order
- Note the region's position and size in an image viewer that shows cursor coordinates.
- Choose a solid block if certainty matters, a strong blur if it does not.
- Extend the region past the edges of the subject.
- Scan the rest of the frame for the same information appearing elsewhere.
- Strip the metadata from the result.
- Look at the exported file, not the preview, before sending it.