What actually happens to the pixels
When you export, the tool draws your original image onto an off-screen canvas at full resolution, then paints each region directly into that pixel grid before encoding a brand-new file. There is no overlay and no second layer:
- Black box / white box overwrite the covered pixels with a single flat color. The original values are gone — not hidden under an opaque shape, replaced.
- Pixelate downsamples the region to a handful of blocks and scales it back up, so a block of many pixels collapses to one averaged color repeated across the area.
- Blur rebuilds the region from a Gaussian blur sampled from the surrounding pixels.
Because the result is a freshly rasterized, single-layer image, it also carries none of the original file’s EXIF metadata. The output is exactly what you see and nothing more — no hidden text layer, no recoverable original, no GPS tag. If you want to inspect what metadata an image holds before sharing it, the EXIF Viewer shows the full record.
Choosing a mode
| Mode | Reversible? | Best for |
|---|---|---|
| Black box | No — pixels overwritten | IDs, account numbers, signatures, anything guessable |
| White box | No — pixels overwritten | The same, on white documents where black looks heavy |
| Pixelate | Sometimes, for simple content | Faces, logos, backgrounds where a hint is acceptable |
| Blur | Sometimes, at low strength | Softening backgrounds, bystanders, general clutter |
The rule of thumb: if an attacker could guess and check the hidden value, only a flat box is safe. Blur and pixelate protect appearance, not low-entropy secrets.
Redaction failures worth learning from
The reason “destructive” is the headline feature is that the most famous redaction leaks were not destructive at all. Black bars have been laid over selectable text in PDFs and lifted with a copy-paste. Mosaicked numbers have been reconstructed by re-pixelating every candidate until one matched. Swirl-obscured faces in old photos were unswirled because the transform was invertible. Every one of these shared a root cause: the original data was still present, merely disguised.
This tool is built to avoid that category of mistake — the covered pixels are replaced in the exported file — but the mode you pick still matters. When in doubt, a black box over the sensitive area, then a quick check in your browser’s Network tab to confirm nothing was uploaded, is the safe workflow. For removing an unwanted region entirely rather than covering it, crop it out instead.