Guide
One sentence carries this page: you cannot prove a redacted file is authentic from the file itself, because the export is a new file — what you can prove, and prove easily, is that every difference between your original and your export falls inside a region you drew, and the work is to keep that provable.
What you are actually being asked to prove
Separate two accusations that sound alike. The first is you did not hide it properly, which is a concealment failure and is what the rest of this site is about. The second is you altered the picture, which is an integrity challenge, and it does not care whether your boxes held. An integrity challenge is cheap to make and awkward to answer: the file plainly has been edited, you are the one who edited it, and the editing was deliberate. “I only covered the private parts” is a claim about your own conduct, which is exactly the claim in dispute.
Notice also that the challenge does not have to be made in bad faith to cost you. A reviewer with a duty to be careful will discount an image they cannot account for, quietly, without telling you why. Many refusals that look like a judgment on the merits are really a judgment that the evidence could not be relied upon. So the target is not winning an argument; it is handing over something that does not need one.
The useful framing is to ask what a sceptical reader could check without trusting you. Not much, if all they have is your export. Quite a lot, if they also have the original and a one-paragraph account of what you did — because then the comparison does the work and your say-so becomes a formality.
The one property you can demonstrate: everything outside your regions is untouched
This is worth being precise about, because it is the technical core of the page and it is unusually clean.
The editor on this page is entirely region-based. There are three methods — Black Box, Blur, Pixelate — and three selection shapes — rectangle, oval, freehand lasso. Every operation does the same thing: it builds a path from the shape you dragged, and it replaces pixels inside that path. There is no crop, no resize, no rotate, no straighten, no brightness or contrast or levels control, no colour adjustment, no clone or heal brush, no text tool and no whole-image operation of any kind. The tool cannot make a global edit, because no code exists in it that would make one.
Two further details turn that architecture into something checkable. When an image loads, the canvas is set to the source image’s exact pixel dimensions, so the export has the same width and height as what you started from — no scaling step exists anywhere in the pipeline. And the export is written with the canvas’s PNG serialiser, which is a lossless format: the pixels in the saved file are the canvas pixels, not an approximation of them.
Put those together and you get a demonstrable invariant. Load your original and your export into anything that can compute a difference between two images — and the comparison is possible at all only because the dimensions match. The difference will be flat and empty across the entire frame except inside the regions you drew. Not approximately empty: empty. The code never reads or writes those pixels, and a lossless encode does not perturb them. Anyone can run that check, it needs no faith in you, and it answers the integrity challenge far better than any assertion you could make.
Two honest caveats, because overstating this would be the exact mistake the page is warning about. First, region boundaries are anti-aliased: the fill and the clip are drawn along a path, so a hairline of pixels right at each edge is blended rather than strictly one thing or the other. The difference image shows that as a faint outline hugging your shapes, which is expected and is not evidence of anything beyond where you drew. Second, if your source was a JPEG, the comparison is between your export and the decoded source, which is what any viewer sees; a byte-level comparison of a PNG against a JPEG is meaningless and is not the test being described.
What the export does not carry, and why that is the trade
The same design that makes the pixel argument clean takes something else away. Because the export is serialised from the canvas bitmap rather than copied from your source container, it does not carry the source file’s metadata. Capture time, device make and model, exposure settings, GPS coordinates, editing history and any provenance or content-credential block that a camera or an earlier editor attached all live in metadata structures belonging to the file format, and a canvas bitmap has no such structures. The saved name is neutral too: a fixed prefix plus a timestamp of the moment you pressed the button, carrying nothing about the content and nothing about the source.
For privacy this is the behaviour you want, and other pages here treat it as a feature — it is why a redacted export does not quietly leak the location where the photo was taken. For a dispute it is a genuine loss, because the metadata is precisely the material that would have corroborated the picture independently of your account of it. You cannot have both from one file. What you can do is stop expecting one file to carry both: let the preserved original carry the provenance, and let the export carry the pixels that are safe to circulate.
It follows that an export is a derived exhibit, not a record. Treat it the way you would treat a photocopy with sections marked out — useful, honest, and meaningful only alongside the thing it was derived from.
A procedure for a redaction you can defend
1. Secure the original before you touch anything. Put the file you received, unmodified and under its original name, somewhere you will not edit it. Note where it came from, who sent it and when. If you can compute a checksum, do it now and write the value down with your notes; its value comes from being recorded early, not from being recorded accurately later.
2. Redact from the original, in one pass. Open that file, draw every cover you need, export once. Do not redact a copy of a copy, do not export halfway and reopen the export to finish, and do not go back later to add one more box to the exported file. Each extra generation breaks the simple story — original in, export out, differences confined to drawn regions — and replaces it with a chain you then have to narrate.
3. Prefer Black Box for anything contentious. A flat fill is self-announcing: its edges are unambiguous and its extent can be measured. Blur and Pixelate are derived from the underlying pixels and therefore still read as picture content, which makes them harder for a reader to delimit and easier for an opponent to characterise as tampering.
4. Write the redaction log while you still remember. One line per cover: what was underneath it, roughly where it sits, and why it is hidden. “Top-right, account number;” “second message, sender’s surname;” “bottom strip, home address.” This takes two minutes and does most of the persuasive work, because it converts a silent black shape into an accounted-for omission. Keep it factual and keep it short.
5. Run the comparison yourself before you send. Confirm the export’s pixel dimensions match the original’s. Then difference the two, or flick between them in a viewer, and satisfy yourself that nothing outside your regions has moved. You are checking your own procedure here as much as the file — this is the step that catches the time you accidentally worked from the wrong copy.
6. Do nothing to the export afterwards. Every later step is another generation and another thing to explain: do not resize it to fit an upload limit, do not re-save it as a JPEG, do not annotate it in a second tool, do not paste it into a document and re-extract it, and above all do not send a screenshot of it. If a size or format constraint forces a change, say what you changed and keep the unmodified export too.
7. Hand over the log and, where appropriate, offer the original. Send the export with its log. If a recipient needs to verify, they need the original, and whether you may or must give it to them is a question about your situation rather than about images — ask the people handling the matter. Offering to make it available under suitable conditions usually ends the argument faster than refusing to discuss it.
8. Expect the hash question and answer it first. The export will not match any checksum of the original, because it is a different file in a different format. Volunteering that fact, with the explanation, is far better than being confronted with it as though it were a discovery.
What the editor above does and does not do here
The tool on this page is region-based: three methods — Black Box, Blur, Pixelate — across three selection shapes, rectangle, oval and freehand lasso. Each operation replaces the pixels inside the path you drew and leaves every other pixel alone. Black Box fills the path with a flat #111111. Blur copies the selection’s bounding box, downsamples it by a factor of ten, scales it back and clips the result to your shape. Pixelate replaces the same bounding box with blocks of a sampled colour. Undo restores an exact pixel snapshot taken before each cover, Clear repaints the retained original, and Download PNG serialises the current canvas as a timestamped PNG. Everything runs in your browser on your own machine, nothing is sent anywhere, and nothing is written to storage.
Four limits matter specifically when integrity is the question. There is no audit trail: the editor keeps its undo snapshots in memory for the open tab and stores nothing at all, so there is no log, no saved project and no edit history for you to produce afterwards. The record has to be the one you write. There is no signing, hashing or provenance feature, and no watermark or stamp — the export is a plain PNG with no assertion of any kind embedded in it. There is no redaction layer: covers are painted destructively into the pixels, so an export cannot be “un-redacted” by a recipient, which is the point, but it also means your export has no machine-readable description of what was covered. And the tool cannot alter the picture globally even if you wanted it to, which is the limit that happens to be working in your favour here, since it bounds the class of edit the file could possibly have received.
Two neighbouring problems are worth reading alongside this one. Checking that your covers really did destroy what was underneath is a separate discipline with its own method, set out in full for verifying a redaction — integrity and concealment are different tests and you want to pass both. And if the image is going into a formal matter, the surrounding handling conventions matter as much as the editing, which is covered for evidence photos in legal cases.
Common mistakes and misconceptions
“The metadata in my redacted file proves when the photo was taken.” It does not, because the export is written from the canvas bitmap and the metadata belongs to the source container. The preserved original is what carries that evidence.
“The hashes do not match, so something went wrong.” They cannot match. A different format, a different encode and a different name guarantee a different digest. The mismatch is expected and carries no information; the useful hash is the one you took of the original before you started.
“Blur looks less heavy-handed than a black box, so it looks less edited.” It is less distinguishable from picture content, which is the opposite of what you want under scrutiny. A flat fill marks its own boundaries; a blurred patch invites questions about what else might have been treated the same way.
“I will redact the version I emailed to myself.” Mail clients, chat apps and photo libraries frequently re-encode and sometimes resize. Redact the original you secured in step one, or you are defending a chain instead of a single step.
“Cropping out the sensitive corner is cleaner than covering it.” Leave aside that this editor has no crop at all — a crop changes the frame, so dimensions no longer match and the whole comparison that underwrites your integrity argument stops being available. A cover inside an unchanged frame is the more defensible move.
“A screenshot of the redacted image is the same thing.” It is a new capture at your display’s scale, with different dimensions and resampled pixels, and it is not comparable with anything. Send the exported file.
“The tool keeps a history I can produce.” It keeps undo snapshots in memory while the tab is open and writes nothing anywhere. Close the tab and there is no record but yours.
“I will just explain it if anyone asks.” Many readers never ask; they discount the image and move on. The log and the preserved original are cheap precisely because they work without a conversation.