Redacting screenshots: why blur is not enough

A blur is a mathematical operation, and many blurs are invertible in principle: a Gaussian blur with a known radius throws away little information, and deconvolution can bring back a legible version of the original. Pixelation (a mosaic) replaces each block with its average colour. For a short string in a known font — a licence plate, an ID number, a password in a screenshot — that leaves enough signal that an attacker can render every candidate string, pixelate each the same way, and pick the one that matches. Published research on depixelation has demonstrated exactly this against text and against faces.

The bigger the blocks and the shorter the alphabet of possibilities, the harder the attack — but "harder" is not "impossible", and you rarely know how much effort someone will spend. The rule is simple: for anything textual, use a solid fill. Reserve blur and mosaic for cases where a rough shape is acceptable to reveal, such as a face in a crowd photo, and use large blocks when you do.

Some effects only look destructive. A twirl or swirl distortion moves pixels around without discarding them; reversing the distortion restores the picture almost exactly. A widely reported criminal case a number of years ago involved a suspect who had hidden his face with a swirl in published photos, and investigators unwound the effect and identified him. Warps, waves, ripples and lens distortions are in the same family: they rearrange, they do not destroy.

Partial transparency is another trap. A black box drawn at 90% opacity, or a "marker" brush with soft edges, leaves a faint version of the content underneath that levels and curves adjustments bring back. The fill has to be fully opaque and the edges hard; anything that lets the original influence the final pixel values is not a redaction.

JPEG files from cameras and phones carry an EXIF block, and the EXIF block usually contains a small thumbnail of the picture as it was taken. Editors that modify the pixels but preserve EXIF — many do, to keep the camera settings — leave the old thumbnail in place. The redacted picture then ships with a miniature unredacted copy of itself. Several publicised incidents involved exactly this: a face or a document blacked out in the main image and clearly visible in the embedded preview.

EXIF and XMP also hold GPS coordinates, the time of capture, the device model and sometimes the owner's name. A screenshot redacted to hide a location still reveals it if the coordinates stay in the metadata. The fix is to write a completely new file from the decoded pixels rather than editing the original in place; a fresh encode carries no metadata unless the tool deliberately adds some.

Layered formats — PSD, TIFF with layers, some editors' native files, and even PDFs exported from an image editor — keep the box and the picture as separate objects. Anyone who opens the file in the same editor can hide or delete the box layer. Export to a flat format, and export the flattened result, not a "save for later editing" variant that bundles the layers.

Transparency in PNG and WebP can mislead in a different way. If the box is painted with transparency, or the image editor uses a mask instead of painting pixels, the colour values of the original may still be stored in the RGB channels with only the alpha channel changed — and a viewer that ignores alpha shows them. Paint opaque pixels, and re-encode the result so that every channel is rewritten.

Decode the image to raw pixels. Paint the redaction as an opaque rectangle of a single colour, with the edges expanded by a pixel or two so that no anti-aliased fringe of the original survives. Flatten everything to one layer. Encode a brand-new PNG or JPEG from those pixels, with no metadata carried over. That is the whole recipe, and it is what RedactDrop does for PNG, JPEG and WebP: the file is drawn onto a canvas, the boxes are painted, and a fresh file is exported.

Then verify, as with a PDF. Re-open the output and confirm the box region is a single flat colour, check with a metadata viewer that EXIF and XMP are empty and no thumbnail exists, and look at the file in a second viewer. For screenshots that contain text, remember that the redaction also has to cover the words, not just the digits: a blacked-out account number next to "Account holder: J. Fischer" has not hidden much.