Free · No Signup

Partial Redaction: How Much Can You Safely Leave Visible?

Every other guide on this site answers how to cover something. This one answers how much — because a partial mask is a deliberate decision to publish the rest, and the rest is usually worth more than it looks.

🔒 No upload · Runs in your browser · Instant download

Almost nobody covers a whole account number. They cover most of it and leave the last four digits, because that is what statements do. They blank a surname and leave the first name. They hide the street but keep the city. They black out the middle of a reference and leave the prefix so the recipient can tell which system it came from. Every one of those is a partial redaction, and every one of them is a decision about how much to publish that was made in about half a second.

That makes it a different problem from the rest of this site. The technique pages are about execution — whether a blur can be undone, whether the box covers the descender on a lowercase g, whether re-compression softens the edge. All of those assume you already know what needs covering. This page is about sizing: given that the field is going to be partly visible, how much of it can you leave without giving away the thing you were protecting? That question has an answer, and the answer is not “however much the bank shows on your statement.”

The short version is that people size partial masks as though an attacker were going to guess the missing characters, when the realistic use of a partial value is matching rather than guessing. A remainder that is useless for reconstruction can be perfectly good for confirming an identity someone had already narrowed down. Below: what a partial mask actually publishes, why remaining-character arithmetic is the wrong test, what a partial reveal costs field by field, and how to draw the mask in the tool on this page so the narrow strip case does not quietly work against you.

Related: blur vs pixelate vs black box.

Mode
Shape

Drop your image here

Or click to browse · Paste with Ctrl+V also works

PNG · JPG · WebP · GIF
How It Works
1

Open

Drop your image in or paste from clipboard.

2

Pick Mode

Black Box, Blur, or Pixelate.

3

Select Areas

Rectangle, oval, or freehand lasso — then hide what you selected.

4

Download

Hit Download PNG. Done.

SquooshNeed to shrink your image after editing? Squoosh is a free browser-based image compressor with no upload required.

Visit Squoosh →
Guide

Start with the distinction that makes this worth a page of its own: a partial mask is not a weaker redaction, it is a publication decision. When you cover a whole field, the question is only whether the covering worked. When you cover part of a field, you have decided that the remainder is safe to release, and that decision gets made by habit — usually by copying a convention you have seen elsewhere, on a document that was designed for a completely different purpose than the one you are sharing.

The convention people copy most is the trailing fragment: the last four digits of a card, the last four of an account, the final characters of a reference. It is everywhere, so it reads as an approved amount to disclose. But the reason statements and receipts show a trailing fragment is not that four digits are harmless. It is that a trailing fragment is a convenient way for a human to confirm which of their own accounts a document refers to. It was designed as a matching aid. Matching aids are excellent at matching, which is the entire problem.

What a partial mask actually publishes

Three things leave the page when you mask part of a field, and only the first is obvious.

Most poorly sized partial masks are failures of the second and third items rather than the first. The masker counted characters, satisfied themselves that not enough were showing to reconstruct anything, and did not notice that the surrounding frame had already done the work.

Why remaining-character arithmetic is the wrong test

Here is the reasoning that makes a last-four mask feel safe. Four digits is one of ten thousand possibilities. Twelve digits are hidden. Nobody is going to brute-force twelve digits from four. Therefore the mask holds.

Every step of that is true and the conclusion still does not follow, because reconstruction is not the threat that a partial identifier actually enables. Two things break the arithmetic.

Structured values have far less hidden entropy than their length suggests. Long institutional identifiers are generally not random strings. They tend to carry a leading block that identifies the issuing institution or product, internal groupings that are constant across everyone at that institution, and in many schemes a check character computed from the others. The exact structure varies by scheme and country and is worth confirming for whatever you are handling rather than assuming, but the direction is consistent: the number of genuinely free characters is smaller, often much smaller, than the number of characters you covered. A mask sized by counting covered glyphs systematically overstates its own strength.

Nobody is guessing anyway. The realistic use of a partial identifier is confirmation. Someone who already has a list — from a breach, from a shared system, from an earlier document, from the public record — does not need to derive your number. They need to know which row is you. A four-character fragment plus a name plus an institution plus a date is a join key of very high quality. Judged as a secret, the remainder is strong. Judged as a key, it is excellent, and keys are what partial fields get used as.

So replace the arithmetic test with a question about capability: what does the visible remainder let a reader do that they could not do without it? If the honest answer is “confirm a guess they could already make,” the mask is not doing its job, no matter how many characters it covers.

The same value, masked twice, two different ways

Partial masks have a failure mode that whole-field masks do not: they compose. Cover the middle of a reference in one image and the two ends of the same reference in another, and a reader holding both simply overlays them. Neither file was badly made. Neither mask was reversed. The disclosure exists only in the pair, which is why it survives review — each image passes on its own.

This is easy to trigger without noticing. You mask a document for one recipient, then months later mask the same document for another, drawing the boxes freehand by eye. The two covered regions will not be identical, and wherever they differ the union shows through. It gets easier still when more than one person is involved, because two people making independent judgements about “enough” will land in different places on the same line of text. Two redacted versions of the same photo can leak each other works through that arithmetic in general; the partial-mask case is its sharpest form, because partial masks are exactly the ones whose boundaries are a judgement call.

The practical rule: a value that appears in more than one release gets one mask, decided once, and every later version is derived from that decision rather than redrawn. If you must produce a second version, make it cover everything the first one covered and then more.

Field by field: what a partial reveal actually costs

None of what follows is a legal standard, and where a rule genuinely applies to you — a payment-industry requirement, an employer’s handling policy, a court’s filing rules — that rule wins over any general reasoning, so go and read it. What follows is about information, not compliance.

Card and account numbers. The trailing fragment is a matching key and should be treated as one. It is usually fine on a document going back to the institution that issued it, because they already know the whole number. It is a different proposition in a public post alongside your name, or in a screenshot that also shows the bank, the branch, the balance and the date. If the recipient needs to confirm which account you mean, consider asking them to state it rather than showing it.

Email addresses. The classic masked form — first character, some dots, the domain — is close to worthless as protection when the reader can also see your name. Most people’s addresses are a predictable function of their name at a common provider, so the mask confirms a guess instead of blocking one. Cover the whole address, domain included, unless the domain is the point.

Phone numbers. An area or country prefix is location data, and the trailing digits are again a matching key. The middle is the least useful part to show and is often the only part people cover.

Names. Masking a surname while leaving a first name works only when the first name is common in the population the reader is drawing from. Inside a company, a school, a small team or a named group, a first name plus the context already visible in the image can be effectively unique. The relevant population is the reader’s shortlist, not the country.

Addresses. Covering the street line while leaving the city rarely matters; covering the street name while leaving a distinctive building, a house number visible elsewhere in the frame, or a recognisable view does. Partial address masking fails through the image rather than through the text more often than not.

Dates of birth. A year on its own feels harmless and combines badly with other coarse attributes. Combinations of low-precision facts narrow a population much faster than each one suggests in isolation, and a date of birth is one of the most commonly used verification fields there is. If you are covering the day and month, there is usually no reason to keep the year.

Reference, case, order and ticket numbers. These are frequently sequential or semi-sequential, which means a visible prefix plus an approximate date can place the record. They are also often looked up directly by anyone with access to the system that issued them. Leaving the prefix “so they know which system it is” is usually better served by writing the system name in the message.

A three-question test before you draw the box

This takes about fifteen seconds and replaces the habit.

  1. What does the reader need to be able to do? Not what looks normal to leave — what task the visible part actually serves. Very often the answer is “nothing,” and the fragment is showing purely out of convention.
  2. Who else might end up seeing this, and what list might they already hold? A partial value that is meaningless to the intended recipient can be a perfect key for a wider audience, and images travel further than they were addressed.
  3. Does the rest of the frame already complete it? The name, the institution, the date, the app, the visible balance. A partial mask is only as good as the least-covered thing in the picture.

If the first answer is “nothing,” cover the whole field. It is the cheapest decision available and it removes the sizing question entirely.

Drawing a partial mask in the tool on this page

Partial masks are almost always long, thin selections — a strip over four characters, a band across the middle of a line — and thin strips are where this editor’s behaviour is worth knowing exactly. All of the following is how the page you are on actually works, read from its own code.

Use Black Box, not Blur or Pixelate. Black Box fills the selected region with a solid dark colour, so the pixels underneath are replaced. Blur and Pixelate both derive their output from the pixels that were there: Blur scales the selection down by a fixed factor and scales it back up, and Pixelate averages into blocks. That is a reduction of the original rather than a replacement of it, which is why the warning bar appears when you pick either of them. It matters more on a narrow strip than anywhere else, because Pixelate sizes its blocks from the shorter side of the selection but never uses blocks smaller than six pixels — over a thin line of text, six-pixel blocks can be small enough for the coarse shape of a character to survive. On a strip that thin you also gain nothing visually from a soft edge, so a solid box has no cost. Blur vs pixelate vs black box compares the three in general.

Very thin drags do nothing at all, silently. A rectangle selection under roughly four pixels in either direction, or an oval under six, is discarded rather than applied, and there is no message when that happens — the dashed outline just disappears. If you are drawing a tight box over a couple of characters and it seems not to have worked, that is why. Drag a visibly larger box.

Your edge precision is coarser than the preview looks. The canvas works at the image’s real pixel dimensions while displaying at whatever width fits the window. On a large screenshot shown scaled down, one pixel of mouse movement covers several image pixels, so a box that looks perfectly aligned with the edge of a character can land a few pixels short. For partial masks this is the difference between covering a digit and leaving a readable sliver of it. Overshoot deliberately: extend the box past the characters on both sides and into the line spacing above and below.

Tightening is additive and free. The covering is painted straight onto the working canvas, Undo steps back through saved snapshots of earlier states, and Clear redraws from the image the page is still holding. Download writes out whatever the canvas currently shows as a freshly encoded PNG, and you can press it more than once in a session. So the safe order is: cover generously, look at it, add more if you are unsure, then export. Adding coverage before you export costs nothing; discovering you left a sliver after you have sent the file costs a great deal.

All of that happens on the device the image is already on. The page reads the file in your browser, draws it into a canvas, and hands the result back as a download — nothing about the picture reaches this site, and there is no account or history for it to sit in. The working copy exists only while the tab is open.

Common mistakes and misconceptions

“Statements only show the last four, so the last four must be safe.” Statements show a trailing fragment so that you can tell your own accounts apart. It is a matching aid, designed for a document going to the account holder, not a disclosure standard for a public post.

Counting covered characters instead of asking what the visible ones enable. The mask that covers twelve of sixteen characters can be worse than the one that covers six, if the four it leaves are the four that link the document to a name.

Masking the middle. Covering the centre of a value and leaving both ends is the single most generous pattern in common use, and it is the one that composes worst with other versions of the same document.

Drawing the box tightly around the characters. A snug box publishes the length and invites a sliver. Cover the whole field, label and underline included, whenever the length itself carries information.

Masking the text and forgetting the picture. A covered address means little if the same frame shows a numbered door, a distinctive view or a delivery label. Partial masks fail through the rest of the image more often than through the characters.

Letting two people size the same mask independently. Two reasonable judgements about “enough” will differ, and where they differ the pair discloses what neither image does alone.

Treating a partial mask as reversible thinking. Once a version is released, tightening it later does not retract the looser one. Size it generously the first time; that is the only time the decision is cheap.

Size the Mask by What the Remainder Enables

A partial redaction is a decision to publish everything you did not cover, and that decision usually gets made by copying a convention — the last four digits, the first initial of an email, the prefix of a reference number. Those conventions exist as matching aids for documents going back to the person they belong to. They were never sizing guidance for something you are about to share more widely.

Counting covered characters is the wrong test, for two reasons. Structured identifiers carry far less hidden entropy than their length implies, and more importantly nobody is guessing: the realistic use of a partial value is confirming which record is yours against a list someone already holds. Ask instead what the visible remainder lets a reader do that they could not do without it. If the answer is “confirm a guess they could already make,” cover the field entirely — and mask the same value identically everywhere it appears, because two differently sized masks of one number overlay into the whole thing.

Partial masks are narrow strips, which is the case where mode choice matters most. HideShot’s Black Box replaces the pixels with a solid fill, while Blur and Pixelate reduce the pixels that were there — and Pixelate never uses blocks below six pixels, so on a thin line of characters the coarse shape of a glyph can survive. Cover generously, past the ends of the value and into the line spacing, then export. All of it runs on the device the image is already on.

Frequently asked questions

Is it safe to leave the last four digits of a card or account number visible?

Not by default - it depends entirely on what else is in the frame and what else exists elsewhere. Four digits on their own are one of ten thousand combinations, which sounds like protection until you remember that nobody is guessing. A partial identifier is a matching key: it exists precisely so that a human can confirm two records refer to the same thing, and that is exactly what it does for anyone holding a list. Put the last four next to a full name, an institution and a date and you have not published a weak secret, you have published a join. The useful test is not how many characters are hidden but whether the visible remainder would let someone confirm a guess they could already make.

I blanked the middle of a number and someone else blanked the ends. Does that matter?

Yes, and it is one of the easiest ways to undo careful work. Masks applied independently to the same value tend not to line up, so one release covers the middle, another covers the ends, and anyone who sees both can overlay them and read the whole thing. Nothing was reversed and neither file was badly made - the disclosure lives in the pair. If a value has to appear more than once, mask it identically everywhere, which in practice means deciding the mask once and deriving every later version from the same source rather than redrawing it by eye.

Does hiding a field but leaving its length visible tell anyone anything?

Sometimes, and it is worth a second of thought rather than a blanket rule. A covering box drawn tightly around the characters publishes how many there were, and for some fields the length is close to the whole answer - it can separate a short internal reference from a long account number, or narrow a masked surname or email handle considerably for a reader who already knows a little about you. It matters least for fields with a fixed, publicly known format, where the length was never secret in the first place. When it does matter the fix costs nothing: draw the box past the end of the value, or cover the whole field including its label and its underline, so the size of the box says nothing about the size of what was under it.

Should I use blur or a black box for a partial mask over a few characters?

Use a black box. The tool on this page paints a solid fill for Black Box, while Blur and Pixelate derive their output from the pixels that were there - a reduction rather than a replacement. That gap matters most in exactly this situation, because a partial mask is usually a narrow strip. Pixelate sizes its blocks from the shorter side of your selection but never goes below six pixels, so over a thin line of characters you can end up with blocks small enough to preserve the coarse shape of a glyph. On a strip that thin there is no visual benefit to a soft edge either, so a solid box costs you nothing.