Blur Faces in Photos

The team photo from the conference is perfect — good light, everyone smiling, the booth banner legible — except for one person in the second row who never signed the release. Marketing wants it in the newsletter today. You need that face gone, convincingly, in the next five minutes, without a round-trip through a desktop editor you last opened in 2022.

Or the version with higher stakes: a protest photo for a news story, where the participants face real consequences for being identifiable. Or the classroom photo a teacher wants to share with parents, minus the two kids whose guardians said no to publication. Or the listing photo where the current owners' family portraits hang on the wall. Same operation, same stakes: a person in the frame who must not be a person in the published frame.

This page is built for exactly that. Paint over a face and it blurs; hit auto-detect and every face the browser can find gets the treatment in one click. Adjustable strength, feathered edges so the blur does not advertise itself with hard rectangles, and — because the subject matter is people who did not consent to wider distribution — no upload, ever.

There is a bar here, and it is higher than most people assume. A blur is not a decorative gesture; it is a claim that identifying information has been destroyed. The claim holds when the operation is strong enough that the face is unrecognizable at full zoom, applied over the whole face with margin — detectors and brushes both tend to crop tightly, and hairlines, ears, and chins identify people too — and executed irreversibly, on a copy that becomes the only copy you publish.

The failure mode everyone has seen is the polite smudge: a 4-pixel blur over a 300-pixel face, leaving the jawline, glasses, and half the expression intact. Anyone who knows the person still knows the person. Under-strength blurring is worse than a black box precisely because it *looks* like anonymization was done, which suppresses the instinct to double-check.

So the working definition this tool is built around: blur until you cannot name the person at 400% zoom, then add a little more. The zoom-inspect mode in the editor exists to make that test a keystroke rather than a guess, and the rest of this article explains what the blur is actually doing to the pixels — because understanding it is what makes the judgment call trustworthy.

1. 1

   Load the photo

   Drag it in, browse, or paste. JPG, PNG, WebP — whatever the browser decodes, at whatever resolution you have. Full resolution is what you want; blurring is applied before export, not after a resize that could re-sharpen edges.

2. 2

   Auto-detect (optional)

   One click asks the browser's face detector for every face it can find. Detected boxes appear with a margin around them — faces run past their boxes more often than not — and you can tap any box to drop it if it caught a poster or a dog.

3. 3

   Paint what the detector missed

   A brush of adjustable size paints blur directly. Feathered edges blend the blurred region into the sharp surroundings, which matters aesthetically and also avoids the crisp rectangle that says 'something was hidden here, try harder.'

4. 4

   Set the strength

   The blur radius slider runs from a polite haze to total fog. Pick by zooming in to 400% and applying the recognition test: if you could still pick the person out of a lineup, increase.

5. 5

   Export and clean up

   Download as PNG or JPG. Then strip the metadata — a blurred face next to an intact GPS coordinate and timestamp is only half an anonymization — and delete the original if the anonymized version is meant to be the only one.

The flow is deliberately short because the decision inside it is the real work: what to blur, how much, and whether the result would survive being looked at closely by someone motivated.

Gaussian blur replaces each pixel with a weighted average of its neighborhood, where the weights follow the bell curve. For a standard deviation of σ = 1, the five-neighbor one-dimensional kernel works out to approximately:

weights:  [0.055  0.244  0.403  0.244  0.055]     (sums to 1)

row of pixels:      [ 50,  60, 200, 210, 220 ]
blurred center  =  0.055·50  + 0.244·60  + 0.403·200
                   + 0.244·210 + 0.055·220
                 =  2.75 + 14.64 + 80.60 + 51.24 + 12.10
                 =  161.3

Read that arithmetic as the whole story of blur: the outlier pixel at 200 gets dragged down toward its neighborhood because the neighborhood's votes outweigh its own. Detail is not hidden — it is averaged away, the sharp value replaced by a committee's opinion. Run the same committee over every pixel in a face, at a large enough σ, and the committee's opinion stops resembling any individual: the identifying structure is gone because it existed in the *differences* between neighboring pixels, and those differences are exactly what the averaging consumes.

Two properties make Gaussian blur the censoring workhorse. It is *isotropic* — blurs equally in all directions, no streaking — and it is *separable*: a two-dimensional Gaussian kernel factors into two one-dimensional passes, horizontal then vertical. The speedup is dramatic as σ grows. A σ = 10 blur needs a kernel roughly 61 pixels wide; applied as a 2D convolution that is 61 × 61 = 3,721 multiply-adds per pixel, while the separable version does 61 + 61 = 122 — thirty times less work, identical result. This is why the blur slider in the tool stays interactive even on large photos: the browser's filter pipeline applies the separable form on the GPU.

The strength control maps to σ directly. The CSS `blur()` function the canvas pipeline uses treats its argument as a diameter of sorts — the W3C Filter Effects specification defines the standard deviation as half the blur length, so `blur(24px)` is σ = 12 pixels of spread in every direction. When the tool's slider says 'strength 12,' that is the number being set.

The one-click option uses the browser's FaceDetector interface — part of the Shape Detection API family, exposed where the platform supports it. You hand it image data; it hands back a list of bounding boxes:

const faces = await faceDetector.detect(imageData);
// -> [{ boundingBox: { x: 1204, y: 810, width: 168, height: 168 } }, ...]

for (const f of faces) {
  blurRegion(f.boundingBox, { margin: 1.25, sigma: 12 });
}

The margin multiplier inflates each box by 25% before blurring — detectors return tight boxes around eyes-and-mouth territory, while humans recognize each other by jaw, hairline, and ears. Blurring the box but not the hairline is a real and common leak, and the margin is the cheap insurance against it.

Detection quality is honest about being statistical. Frontal and three-quarter faces at reasonable resolution: found reliably. Profile faces, faces in deep shadow, small faces in crowd backgrounds, faces behind sunglasses: missed at a meaningful rate. The tool treats detection as an assistant, not an authority — every detected box is removable, the brush always overrides, and the published result should always get one human zoom-pass before export. When the browser lacks FaceDetector support entirely, the tool degrades gracefully to brush-only, which is slower but never wrong.

A note on scope: the detector finds faces and only faces. License plates, names on badges, documents on desks, and reflections in windows are identification information too, and they are brush work. The blur does not care what it is destroying — the judgment about what deserves destruction stays yours.

A concrete run, with the numbers. The input is a 4032 × 3024 group photo from a product launch — nine people, one who must not be published. Auto-detect returns nine boxes; the subject's box sits at x 1420, y 980, 420 × 420 pixels, and the 25% margin expands the blur region to 525 × 525.

The verification row is the one people skip and should not. Zoom to 400%, look at the blurred region the way a motivated stranger would, and ask whether anything — a jawline, a hair part, a pair of distinctive glasses — survives. The example above shows the actual decision the σ slider is asking you to make: the difference between σ 6 and σ 14 is the difference between decoration and anonymization.

For the other eight people, the same pipeline ran in the auto pass at a lighter σ — they consented to the internal newsletter, so they got a 'these people existed' soft blur only where policy required it. One tool, two strengths, one exported file. The distinction between those two treatments is precisely the judgment that no automated service should be making for you.

Three censoring strategies, with different residue:

The reversibility row deserves its reputation check. Neither blur nor pixelation can be undone from the published file — the information is destroyed — but research has repeatedly shown that neural networks trained to undo *weak* blurs and *small-block* pixelation can recover recognizable structure. The lesson is not 'blur is broken'; it is 'weak blur is broken.' At σ large enough to pass the 400% test, both methods destroy more than any network can rebuild, and the solid box destroys everything by construction.

The aesthetic difference is not trivial either. A soft Gaussian blur reads as professional redaction; pixelation reads as retro censor-bar and, on a colorful photo, pulls the viewer's eye straight to the hidden thing. For faces in editorial photography, blur wins the tone argument. For a license plate or a document under a strong duty to protect, the blunt black box wins the certainty argument, and choosing it is a feature of good judgment rather than a failure of style.

When the retro look is the goal rather than the redaction, the pixelate tool does that half of the family deliberately, with block-size control for the aesthetic range.

The operation is solid; the surrounding workflow is where anonymization leaks:

• Under-strength blur. Covered above, worth repeating once: the polite smudge is the number-one failure in the wild. Zoom in, apply the recognition test, increase until it passes.
• Blur bleed at edges. Blurring a region naively pulls in sharp pixels from just outside it — including a sliver of face you meant to protect. The tool masks before blurring so the effect stays inside the painted region; hand-rolled scripts usually skip this and leak a recognizable strip.
• Detection misses. Profile faces, shadowed faces, small faces in crowds, faces in photographs *within* the photograph. The human zoom-pass catches what the detector does not.
• Identifiers beyond the face. Tattoos, distinctive clothing, name badges, house numbers, street signs, the view out the window. A perfectly blurred face in a perfectly identifiable context is not anonymization.
• Metadata. Blur touches pixels only. GPS, timestamp, and device model live in EXIF and travel with the file unless stripped — the EXIF remover is the mandatory companion step for anything being published.
• The original file. If the goal is that the anonymized version is the only version, deleting the original is your job; no browser tool can reach your disk's trash folder, and none should.

Journalists and documentary photographers, where the stakes are highest and the practice is oldest — source protection, protest coverage, minors, people in legal jeopardy. For them the workflow is muscle memory: strong blur, margin, metadata strip, original under embargo.

Teachers and school administrators blur classroom and event photos before newsletters and websites — consent forms cover most families, and the blur covers the rest. Real-estate photographers blur family portraits and personal effects in listing shots. Marketplace sellers blur plates in car photos and faces in the background of product shots. HR teams blur non-consenting employees in company-event photos for internal channels.

And a large, quiet population sharing everyday life responsibly: the running-club group photo posted publicly, the birthday party where three guests are careful about their online presence, the street photo with strangers in frame. The tool's job is to make the careful thing take thirty seconds instead of thirty minutes, because friction is what decides whether protection happens at all.

The privacy-tooling family fits together for this crowd: Pixelate Image for the other censoring aesthetic, the EXIF Remover for the metadata half of the job, and the Watermark Image Adder for the adjacent need to claim authorship rather than hide identity.

The phone-marker route deserves its row because it is what people actually do in a hurry — and finger-painted rectangles at fixed strength are exactly how under-blurred photos reach the internet. The desktop editors are overkill for a single redaction and under-available at the moment one is needed; the upload-based services have the strength controls but insist on receiving the photo of the person who did not consent, which for this specific task is a strange ask.

A browser tool with no upload path sits precisely where the task lives: sensitive input, quick judgment, local processing, done. The FaceDetector bonus removes the tedium from group shots, and the strength control removes the guesswork from the only decision that matters.

It bears stating without euphemism: the input to this tool is photographs of people who, by definition of the task, have not consented to wider distribution. Routing that file through a processing server — even a reputable one, even one with a deletion policy — adds a party to the story who was not in it before. This page runs detection, blurring, and export entirely in the browser, and its network panel shows nothing after load, which is the check that matters when the stakes are somebody else's privacy.

The offline corollary is practical rather than philosophical: field journalism, secure facilities, and offline laptops all keep working. And the no-backend architecture means no size caps, no watermarks, no conversion quota, and no retention question to answer in a review meeting — the constraints that upload-based tools impose exist to protect their servers, and a tool with no server has none of them.

Privacy tooling that itself leaks is worse than no tooling — it launders the risk. The design brief here was to be the instrument that never becomes part of the problem it exists to solve.

Companion stops: Pixelate Image when block-style censoring fits better, the EXIF Remover to strip the GPS and device metadata that blurring cannot touch, and the Watermark Image Adder for the opposite problem — proving authorship instead of hiding identity.