Image Redaction

Black Out ID Numbers and Faces Without Uploading the Photo

This tool hides parts of a JPG, PNG, WebP, AVIF or HEIC photo under solid black boxes, for example the number on an ID card, a passport machine-readable zone, a face, an address or a bank detail on a screenshot. VaultTools runs the redaction and the checks in Rust compiled to WebAssembly inside your tab, so the photo of your document is never uploaded anywhere.

How to redact an image

1. Drop a photo on the drop zone, or tap it to pick one from your phone or computer.
2. Drag over each area that must disappear. Every drag adds a zone. On a phone, use one finger to draw and two fingers to zoom and move. On a computer, scroll over the image to zoom.
3. Turn on Magnifier to see an enlarged view under your finger while you draw, so your thumb does not hide the digits you are aiming at.
4. Tap or click a zone to select it. Drag it to move it, drag a corner to resize it, or press Delete. Undo reverts the last change.
5. Press Export. The tool writes a new file, reads it back and runs every check. The exported image appears with one line per check.
6. If every check passes, press Download. The file is saved as name-redacted.jpg for JPEG input and name-redacted.png for every other format.

What makes the redaction hold

• Opaque black, not a filter: every pixel inside a zone is set to pure black. Nothing semi-transparent is left for software to reverse. Blur is deliberately not offered, because blurred or pixelated text can sometimes be reconstructed.
• A new file, not an edited one: the output is encoded from scratch from the modified pixels. No byte of the original container is copied, so hidden parts of the original file cannot travel along.
• No metadata: EXIF, GPS position, camera model, XMP, comments, ICC profiles and the small preview thumbnail that phones embed in JPEG files are all absent from the output.
• Exactly what you see: the editor shows the image after the tool has applied the EXIF orientation itself, so a zone drawn on a rotated phone photo lands on the same pixels in the file.
• Hidden colours under transparency: fully transparent pixels can still carry colour values. They are set to black everywhere in the image, which changes nothing you can see.

The proof screen: two checks before download

Export does not trust its own memory. It inspects the bytes of the file it just wrote, the same bytes you will download. The first check, in WebAssembly, reads the file structure and only accepts image data: one image, the expected dimensions, no metadata block, no thumbnail, nothing after the end of the image. It then decodes the file and confirms that every pixel in every zone is opaque black.

The second check uses a different decoder, the one built into your browser. It decodes the file again at full resolution, reading large photos in tiles instead of shrinking them, and checks the zones once more. The image shown on the proof screen is the exported file as decoded by your browser, which is what the recipient will see. The Download button only exists when both checks pass. If any check fails, no download is offered for that file and the tool tells you which check failed.

Formats and output

• JPG / JPEG: saved as JPEG so the file size stays close to the original, which matters for upload forms with size limits. JPEG compresses pixels in 8 by 8 blocks, so each zone grows outward to a 16 pixel safety grid that contains whole blocks, and no block mixes black with original content. The proof image shows that slightly larger box.
• PNG and WebP: saved as PNG, a lossless format, so zones are exactly the size you drew.
• HEIC / HEIF (iPhone photos): converted to PNG locally in your browser by libheif, compiled to WebAssembly, then redacted and saved as PNG. A HEIC file that holds several separate images is refused, like an animated file.
• AVIF: decoded by your browser and saved as PNG.

Limits to know

• PDF redaction is not supported. A PDF can hold text, layers and earlier versions that a picture tool cannot see. To share one page, export it as an image first.
• Animated PNG, WebP and AVIF files are refused, because frames you do not see in the editor could still show the information.
• Very large photos need a lot of memory, because the tool holds and checks the whole image at full resolution. Limits by format: about 179 megapixels for a colour JPEG, about 200 megapixels for a greyscale JPEG (the header cap), and about 134 megapixels for PNG, WebP, AVIF and HEIC (these are decoded as RGBA). Larger images are refused.
• Files that cannot be decoded completely are refused rather than processed halfway.
• The colour profile is not kept. Photos taken on recent phones in a wide colour space can look slightly less saturated after redaction. The zones are not affected.
• The tool covers only what you draw. It does not detect text or faces for you, so check the proof image before sending it.
• The original file on your device is not changed. Delete it yourself if you no longer need it.

Why redact in your browser?

The photos people redact are the most sensitive ones they own: identity cards, passports, driving licences, payslips, bank statements and screenshots of private messages. Sending them to an online editor to hide the number means a stranger's server receives the full, unredacted document first, often with the GPS position and phone model still in the EXIF data. Here the original stays on your device, the work happens in this tab, and the only file that ever exists outside the tool is the verified copy you choose to download.

Frequently asked questions

Can someone remove the black box and see what was under it?

No. The pixels under a zone are replaced with black in a brand new file. The original values are not stored anywhere in it, not in a layer, not in a thumbnail, not in metadata, and the proof screen checks this before the download appears.

Why not blur instead of black boxes?

Blur and pixelation keep part of the original information, and short strings such as document numbers can sometimes be guessed back from them. A solid black fill keeps nothing.

Does it work on a phone?

Yes. Draw with one finger, pinch to zoom, and use the magnifier to aim precisely.

Is the location of my photo removed?

Yes. The output contains no EXIF block at all, so GPS coordinates, date, camera model and the embedded preview image are gone.

Can I redact a PDF?

Not with this tool. Only JPG, PNG, WebP, AVIF and HEIC images are accepted.

Is my photo uploaded?

No. Reading, redacting, encoding and both checks happen locally in your browser. No request carries your image to a server.