Guide
One sentence carries this page: on a records release the redaction is not just a cover but a representation — it has to leave behind everything segregable, show how much was removed, and carry a citable reason, and this editor can only do the first two of those three.
What a records law asks of a redaction
The federal Freedom of Information Act is the clearest written version of the obligation, so it is worth quoting rather than paraphrasing. Three passages matter.
On when you may withhold at all, 5 U.S.C. § 552(a)(8)(A) directs that an agency shall withhold information only if — (I) the agency reasonably foresees that disclosure would harm an interest protected by an exemption described in subsection (b); or (II) disclosure is prohibited by law
, and shall consider whether partial disclosure of information is possible whenever the agency determines that a full disclosure of a requested record is not possible
and take reasonable steps necessary to segregate and release nonexempt information
.
On what is left over, the closing lines of § 552(b) provide that Any reasonably segregable portion of a record shall be provided to any person requesting such record after deletion of the portions which are exempt under this subsection.
And on marking, the same passage continues: The amount of information deleted, and the exemption under which the deletion is made, shall be indicated on the released portion of the record, unless including that indication would harm an interest protected by the exemption in this subsection under which the deletion is made. If technically feasible, the amount of the information deleted, and the exemption under which the deletion is made, shall be indicated at the place in the record where such deletion is made.
Read those together and a records redaction has three duties rather than one: segregate and release, indicate the extent, and name the exemption. Nothing on the rest of this site asks for the second or the third.
One scope warning, and it is a real one. That is the federal statute, binding on federal agencies. If you are a county clerk, a police department, a school district, a water authority or a contractor answering a state request, your own public records law governs: the exemption list is different, the marking requirement may be stronger, weaker or absent, and so is the appeal route. Take the passages above as the shape of the obligation and check your own statute, your agency's manual or your records counsel for the content. This page is about what an image editor can and cannot do for you; it is not legal advice, and the person who signs the response decides.
Duty one: segregate, do not bulk-withhold
For a photograph, segregability is spatial. The exempt material occupies some part of the frame — a bystander's face, a complainant's house number, a case file number on a monitor — and the rest of the frame is the reasonably segregable portion you owe the requester. The statutory instinct therefore runs opposite to the instinct this site usually trains: cover the face and release the photograph, rather than withholding the photograph because there is a face in it.
Two edges to that. If the exempt thing genuinely is the whole frame — the entire image is a person's medical chart, or the subject of the photograph is itself the protected fact — then there is no segregable portion, and the honest response is a withholding with a stated basis, not a wholly black rectangle produced as though it were a record. And if the exempt material is distributed across the picture rather than sitting in a place, a box cannot reach it; the identifier that is not shaped like a region is a recurring problem with its own treatment, and the answer there is usually to withhold the image rather than publish a cover that does not work.
Duty two: let the box show its own extent
This is the one place on this site where you want the redaction to be loud. The visible mark is your indication of the amount deleted, so it has to read unmistakably as a deliberate deletion.
That rules out Blur and Pixelate on a release copy, and not only for the usual reason. Blur in this editor downsamples the selected area by a fixed factor of ten and scales it back up; Pixelate fills each block with one sampled pixel, using a block size of the selection's shorter side divided by twelve with a six-pixel floor. Both preserve coarse structure by design, so a face can stay recognisable as a shape. But the compliance problem is separate: a softened region does not tell the reader that anything was removed. It looks like a bad photograph. A flat #111111 fill with a hard edge announces itself, and that self-announcement is the part the statute is asking for.
The corollary is that box size is a representation too. An oversized rectangle swept across half the frame overstates what was exempt and invites the question of what else went under it; a box drawn tight inside the edge of a face understates the deletion and risks leaving a jaw line or a hairline outside it. Aim for the exempt material plus an honest margin, consistently, across every image in the production.
One mechanical trap in this editor matters more here than anywhere else: a rectangle drag under about four image pixels, or an oval under six, is discarded silently. A small box over a case number or a date of birth can simply fail to appear, with no warning and no visible difference until someone reads the produced file. Confirm every box is actually on the canvas before you download, and remember that the canvas is displayed scaled to fit while the edits land at the source's full pixel dimensions.
Duty three: the exemption cannot go on the image
Here is the hard limit, stated plainly. This editor cannot write the exemption at the place of deletion. There are three modes and three shapes; every operation replaces the pixels inside a path you draw; there is no text tool, no annotation layer, no caption and no colour choice, and the page's editor code contains no text-drawing call whatsoever. No amount of technique will put (b)(6) beside a box.
Federal FOIA conditions the place-of-deletion marking on technical feasibility, and feasibility is a property of your toolchain rather than a reason to drop the requirement. So the citation has to travel next to the image. Three workable arrangements, in increasing order of effort:
A redaction log plus the response letter. The letter names the exemptions relied on; the log gives one row per covered region so the reader can tie each box to a basis. This is the minimum, and for most image productions it is enough.
The image placed in a document with captions. Drop the redacted PNG into a word processor or PDF with a numbered caption under each figure and the exemption code in the caption. The deletion is still done here, destructively, at the pixel level; the labelling is done where text is possible.
A stamping step. If your practice or your statute requires the code adjacent to each mark on the face of the record, you need a tool that writes text onto the page after the pixels are gone. Do the destruction here first, so the stamping tool never holds the unredacted pixels in a layer somebody can peel off.
Describing what you removed in writing has a failure mode of its own — a note can disclose exactly what the box was hiding — and that trade-off is worked through in explaining what you redacted without undoing the redaction. For a records response the usual answer is to name the category and the exemption, never the value.
A redaction log for images
Document productions get a log almost for free, because pages are numbered and text can be quoted. Images need one built by hand. One row per covered region, not per file:
Produced filename. This editor exports as hideshot-<timestamp>.png, so rename it to your production naming scheme before it leaves your working folder — and do not encode the withheld content in the new name.
Source file and where the unredacted original sits. The production copy is not the record; the original is. Retention and preservation of records under request is the records officer's call and your statute's, not a step in an image editor.
Region number and rough location in the frame. “Three faces along the counter, upper left”, “account number, lower right panel”. Because an image has no words or lines, the natural unit for “amount deleted” is a count of regions plus a description of each.
Class of information covered. The category, never the value. “Third-party name”, not the name.
Exemption cited. Per region. A single incident photo can easily carry a bystander's face, a complainant's address and an internal case number under three different bases.
Mode used, decided by, date. Black Box throughout, if you follow this page. The initials and the date are what let someone defend the response a year later.
The log earns its keep in two moments. First, on appeal or review, when you will be asked what was under each box and need to answer without producing the original. Second, when a different requester asks for the same records later — because if you redraw the boxes freehand on a second production, the two releases will not agree, and the pair discloses the union of what either one left visible. Consistency across productions is a logging problem, not a drawing problem.
Why image productions behave worse than document productions
Screenshots of internal systems carry chrome. The record requested is the case note; the capture also contains the operator's username, a workstation name, an internal URL with a record identifier, a clock that fixes the time zone, and a row of notification badges. Little of it is responsive to the request and some of it may be exempt on security grounds, but blanket-covering the whole periphery can look like you hid substance. Decide deliberately, and log the decision.
The frame is preserved, which is useful. There is no crop, resize or rotate anywhere in this editor, and the canvas is created at the source image's exact pixel dimensions, so the file you download is the same frame at the same size as the source with painted regions inside it. That is an easy property to state in a response and an easy one for a reviewer to verify.
Metadata does not survive, which cuts both ways. Download PNG serialises the canvas bitmap, so the produced file carries none of the source's EXIF or provenance fields. Good news if the camera recorded GPS coordinates you had not planned to release; worth a note if your records system expects a produced copy to retain capture metadata. Either way, the original keeps its metadata and stays in the file.
Faces are the common case and the hardest to bound. Agencies releasing stills from body-worn or fixed cameras run into uninvolved bystanders constantly, and that specific situation — which faces are incidental, how much of the surrounding frame identifies them anyway — is covered in more detail in blurring faces in body cam footage. On a records release, use Black Box there too, for the extent-marking reason above.
Clear has no confirmation. The Clear button repaints the retained original over your work immediately, with no prompt, and it wipes the undo history with it. Forty boxes into a long screenshot that is an expensive misclick, and there is no autosave anywhere, because nothing is persisted outside the tab.
Common mistakes and misconceptions
“There is a face in it, so withhold the photo.” Segregability points the other way: release the frame, cover the face, and record why.
“Over-redacting is the safe error.” Not on this side of the transaction. Withholding beyond the exemption is withholding without a foreseeable-harm basis, and it is the most common thing an appeal is about.
“Blur is gentler and still counts.” Gentler is the wrong axis. A factor-of-ten downsample can leave a recognisable shape, and a soft patch does not indicate to the reader that anything was deleted at all.
“The box is the record of what I did.” The box shows extent. It does not show the reason, the category or who made the call, and without those the response cannot be defended by anyone except the person who drew it.
“I will redact it and delete the original so it cannot leak.” Destroying a record that is under request is the one move in this whole workflow with serious consequences. Custody of the original is a records decision, and the correct answer is almost always to keep it where it already lives.
“Marking the exemption on the image is optional.” Federal FOIA asks for it at the place of deletion where technically feasible, and on the released portion of the record regardless, subject to the harm proviso. This tool cannot do the on-image part, so another step in your chain has to.
“A second request for the same photo can just be redacted again.” Redraw by hand and the second set of boxes will not match the first. Two productions of one photograph release everything that either version left visible.
“The requester will not zoom in.” Assume the opposite. A released image is a published image: it will be inspected at full resolution, enhanced, and compared against the other copies already in circulation.