Guide
Start with the distinction that makes this worth a page of its own: a partial mask is not a weaker redaction, it is a publication decision. When you cover a whole field, the question is only whether the covering worked. When you cover part of a field, you have decided that the remainder is safe to release, and that decision gets made by habit — usually by copying a convention you have seen elsewhere, on a document that was designed for a completely different purpose than the one you are sharing.
The convention people copy most is the trailing fragment: the last four digits of a card, the last four of an account, the final characters of a reference. It is everywhere, so it reads as an approved amount to disclose. But the reason statements and receipts show a trailing fragment is not that four digits are harmless. It is that a trailing fragment is a convenient way for a human to confirm which of their own accounts a document refers to. It was designed as a matching aid. Matching aids are excellent at matching, which is the entire problem.
What a partial mask actually publishes
Three things leave the page when you mask part of a field, and only the first is obvious.
- The visible characters. The part you chose to keep. This is the one everybody counts.
- The shape of what you covered. A box drawn tightly around the hidden characters announces how many of them there were, roughly how wide they were, and often where the separators fell. For a field with a fixed public format that costs nothing. For a surname, an email handle, an internal reference or a free-text note, the length can be a large fraction of the answer.
- The fact that the field is there at all. A black rectangle in the middle of a form says: this document contains that kind of value, for this person, from this institution, on this date. Sometimes that is the sensitive part and the characters were never the point.
Most poorly sized partial masks are failures of the second and third items rather than the first. The masker counted characters, satisfied themselves that not enough were showing to reconstruct anything, and did not notice that the surrounding frame had already done the work.
Why remaining-character arithmetic is the wrong test
Here is the reasoning that makes a last-four mask feel safe. Four digits is one of ten thousand possibilities. Twelve digits are hidden. Nobody is going to brute-force twelve digits from four. Therefore the mask holds.
Every step of that is true and the conclusion still does not follow, because reconstruction is not the threat that a partial identifier actually enables. Two things break the arithmetic.
Structured values have far less hidden entropy than their length suggests. Long institutional identifiers are generally not random strings. They tend to carry a leading block that identifies the issuing institution or product, internal groupings that are constant across everyone at that institution, and in many schemes a check character computed from the others. The exact structure varies by scheme and country and is worth confirming for whatever you are handling rather than assuming, but the direction is consistent: the number of genuinely free characters is smaller, often much smaller, than the number of characters you covered. A mask sized by counting covered glyphs systematically overstates its own strength.
Nobody is guessing anyway. The realistic use of a partial identifier is confirmation. Someone who already has a list — from a breach, from a shared system, from an earlier document, from the public record — does not need to derive your number. They need to know which row is you. A four-character fragment plus a name plus an institution plus a date is a join key of very high quality. Judged as a secret, the remainder is strong. Judged as a key, it is excellent, and keys are what partial fields get used as.
So replace the arithmetic test with a question about capability: what does the visible remainder let a reader do that they could not do without it? If the honest answer is “confirm a guess they could already make,” the mask is not doing its job, no matter how many characters it covers.
The same value, masked twice, two different ways
Partial masks have a failure mode that whole-field masks do not: they compose. Cover the middle of a reference in one image and the two ends of the same reference in another, and a reader holding both simply overlays them. Neither file was badly made. Neither mask was reversed. The disclosure exists only in the pair, which is why it survives review — each image passes on its own.
This is easy to trigger without noticing. You mask a document for one recipient, then months later mask the same document for another, drawing the boxes freehand by eye. The two covered regions will not be identical, and wherever they differ the union shows through. It gets easier still when more than one person is involved, because two people making independent judgements about “enough” will land in different places on the same line of text. Two redacted versions of the same photo can leak each other works through that arithmetic in general; the partial-mask case is its sharpest form, because partial masks are exactly the ones whose boundaries are a judgement call.
The practical rule: a value that appears in more than one release gets one mask, decided once, and every later version is derived from that decision rather than redrawn. If you must produce a second version, make it cover everything the first one covered and then more.
Field by field: what a partial reveal actually costs
None of what follows is a legal standard, and where a rule genuinely applies to you — a payment-industry requirement, an employer’s handling policy, a court’s filing rules — that rule wins over any general reasoning, so go and read it. What follows is about information, not compliance.
Card and account numbers. The trailing fragment is a matching key and should be treated as one. It is usually fine on a document going back to the institution that issued it, because they already know the whole number. It is a different proposition in a public post alongside your name, or in a screenshot that also shows the bank, the branch, the balance and the date. If the recipient needs to confirm which account you mean, consider asking them to state it rather than showing it.
Email addresses. The classic masked form — first character, some dots, the domain — is close to worthless as protection when the reader can also see your name. Most people’s addresses are a predictable function of their name at a common provider, so the mask confirms a guess instead of blocking one. Cover the whole address, domain included, unless the domain is the point.
Phone numbers. An area or country prefix is location data, and the trailing digits are again a matching key. The middle is the least useful part to show and is often the only part people cover.
Names. Masking a surname while leaving a first name works only when the first name is common in the population the reader is drawing from. Inside a company, a school, a small team or a named group, a first name plus the context already visible in the image can be effectively unique. The relevant population is the reader’s shortlist, not the country.
Addresses. Covering the street line while leaving the city rarely matters; covering the street name while leaving a distinctive building, a house number visible elsewhere in the frame, or a recognisable view does. Partial address masking fails through the image rather than through the text more often than not.
Dates of birth. A year on its own feels harmless and combines badly with other coarse attributes. Combinations of low-precision facts narrow a population much faster than each one suggests in isolation, and a date of birth is one of the most commonly used verification fields there is. If you are covering the day and month, there is usually no reason to keep the year.
Reference, case, order and ticket numbers. These are frequently sequential or semi-sequential, which means a visible prefix plus an approximate date can place the record. They are also often looked up directly by anyone with access to the system that issued them. Leaving the prefix “so they know which system it is” is usually better served by writing the system name in the message.
A three-question test before you draw the box
This takes about fifteen seconds and replaces the habit.
- What does the reader need to be able to do? Not what looks normal to leave — what task the visible part actually serves. Very often the answer is “nothing,” and the fragment is showing purely out of convention.
- Who else might end up seeing this, and what list might they already hold? A partial value that is meaningless to the intended recipient can be a perfect key for a wider audience, and images travel further than they were addressed.
- Does the rest of the frame already complete it? The name, the institution, the date, the app, the visible balance. A partial mask is only as good as the least-covered thing in the picture.
If the first answer is “nothing,” cover the whole field. It is the cheapest decision available and it removes the sizing question entirely.
Drawing a partial mask in the tool on this page
Partial masks are almost always long, thin selections — a strip over four characters, a band across the middle of a line — and thin strips are where this editor’s behaviour is worth knowing exactly. All of the following is how the page you are on actually works, read from its own code.
Use Black Box, not Blur or Pixelate. Black Box fills the selected region with a solid dark colour, so the pixels underneath are replaced. Blur and Pixelate both derive their output from the pixels that were there: Blur scales the selection down by a fixed factor and scales it back up, and Pixelate averages into blocks. That is a reduction of the original rather than a replacement of it, which is why the warning bar appears when you pick either of them. It matters more on a narrow strip than anywhere else, because Pixelate sizes its blocks from the shorter side of the selection but never uses blocks smaller than six pixels — over a thin line of text, six-pixel blocks can be small enough for the coarse shape of a character to survive. On a strip that thin you also gain nothing visually from a soft edge, so a solid box has no cost. Blur vs pixelate vs black box compares the three in general.
Very thin drags do nothing at all, silently. A rectangle selection under roughly four pixels in either direction, or an oval under six, is discarded rather than applied, and there is no message when that happens — the dashed outline just disappears. If you are drawing a tight box over a couple of characters and it seems not to have worked, that is why. Drag a visibly larger box.
Your edge precision is coarser than the preview looks. The canvas works at the image’s real pixel dimensions while displaying at whatever width fits the window. On a large screenshot shown scaled down, one pixel of mouse movement covers several image pixels, so a box that looks perfectly aligned with the edge of a character can land a few pixels short. For partial masks this is the difference between covering a digit and leaving a readable sliver of it. Overshoot deliberately: extend the box past the characters on both sides and into the line spacing above and below.
Tightening is additive and free. The covering is painted straight onto the working canvas, Undo steps back through saved snapshots of earlier states, and Clear redraws from the image the page is still holding. Download writes out whatever the canvas currently shows as a freshly encoded PNG, and you can press it more than once in a session. So the safe order is: cover generously, look at it, add more if you are unsure, then export. Adding coverage before you export costs nothing; discovering you left a sliver after you have sent the file costs a great deal.
All of that happens on the device the image is already on. The page reads the file in your browser, draws it into a canvas, and hands the result back as a download — nothing about the picture reaches this site, and there is no account or history for it to sit in. The working copy exists only while the tab is open.
Common mistakes and misconceptions
“Statements only show the last four, so the last four must be safe.” Statements show a trailing fragment so that you can tell your own accounts apart. It is a matching aid, designed for a document going to the account holder, not a disclosure standard for a public post.
Counting covered characters instead of asking what the visible ones enable. The mask that covers twelve of sixteen characters can be worse than the one that covers six, if the four it leaves are the four that link the document to a name.
Masking the middle. Covering the centre of a value and leaving both ends is the single most generous pattern in common use, and it is the one that composes worst with other versions of the same document.
Drawing the box tightly around the characters. A snug box publishes the length and invites a sliver. Cover the whole field, label and underline included, whenever the length itself carries information.
Masking the text and forgetting the picture. A covered address means little if the same frame shows a numbered door, a distinctive view or a delivery label. Partial masks fail through the rest of the image more often than through the characters.
Letting two people size the same mask independently. Two reasonable judgements about “enough” will differ, and where they differ the pair discloses what neither image does alone.
Treating a partial mask as reversible thinking. Once a version is released, tightening it later does not retract the looser one. Size it generously the first time; that is the only time the decision is cheap.