Can a Pixelated Image Be Reversed?

Start with what pixelation actually does. The image is divided into a grid of blocks, and every pixel inside a block is replaced with the average color of that block. A 20 by 20 block contains 400 color measurements before, and one after.

Those 399 discarded measurements are not hidden, compressed, or stored elsewhere. Once the file is exported, they do not exist in it. In that strict sense pixelation is irreversible, and no tool can reach into a pixelated file and pull the original detail back out.

How inference attacks work

Pixelation is a deterministic function. The same input, block size and grid alignment always produce the same output. That is a useful property to have as an attacker.

If you can guess what was underneath, you can test it. Take a candidate, apply the identical pixelation, and compare the resulting blocks against the ones in the published image. A close match is strong evidence the candidate is correct. Repeat across every plausible candidate and you have brute-forced the redaction, without ever reversing anything.

This works precisely when the set of candidates is small enough to enumerate. That single condition explains almost everything about when pixelation is safe.

Why text is the dangerous case

Pixelated text is the standard example of this attack succeeding. Consider a redacted six-digit number rendered in a common font at a known size. There are only a million possibilities, the font shapes are known, and the rendering is reproducible. A script can generate all of them, pixelate each, and rank them by similarity in a matter of seconds.

This is not theoretical. In February 2022, Dan Petro at the security firm Bishop Fox published an open source tool called Unredacter that recovers pixelated text from screenshots. It reads the font and size from the surrounding un-redacted text, renders every candidate string in that same font, pixelates each one, and compares the blocks against the redaction. An earlier tool called Depix worked along similar lines. Bishop Fox's own write-up put the conclusion plainly: never use pixelation to redact text.

Everything with a constrained format is exposed to the same problem: license plates, order numbers, phone numbers, email addresses, dates, postcodes, and short passwords.

Why faces are much safer

A face cannot be brute-forced the same way. The space of possible human faces, under arbitrary lighting, angle, and expression, is not something you can enumerate and test. There is no finite candidate list.

What does exist are machine learning models that generate a plausible sharp face consistent with a pixelated input. These are worth understanding correctly: such a model is not recovering the person, it is inventing a face that would pixelate to something similar.

The clearest illustration came in June 2020, when Duke University's PULSE model was given a pixelated photo of Barack Obama and produced a white man. Others reproduced the effect within days using images of Kamala Harris and Lucy Liu. The cause was the training data: the underlying StyleGAN model had learned from faces scraped from Flickr that skewed heavily white, so that is what it produced. The output was never a recovery of the original face. It was the model's best guess, shaped by what it had seen most often.

The practical risk is narrower but real. If someone already has a short list of candidates, say the handful of people who could have been in that room, a heavily pixelated face may still carry enough signal in skin tone, hair color, head shape and build to pick between them. Anonymity against the general public is not the same as anonymity against someone who knows the context.

What makes pixelation stronger

• Larger blocks. Every increase in block size averages away more measurements. The relationship is steep: doubling the block size quadruples the number of pixels collapsed into each value.
• Fewer blocks over the subject. Aim for a handful of blocks across a face rather than dozens. If the subject is still recognizable in outline, the setting is too low.
• Re-encoding the result. Exporting to JPEG adds compression artifacts that slightly perturb the block values, which weakens exact-match correlation. This is a marginal benefit, not a strategy.
• Not publishing the parameters. An attacker who knows the exact block size and grid offset has an easier time. This is minor obfuscation, since both can be measured from the image itself.

What defeats it entirely

Two failures make the block size irrelevant:

The original is still out there

If the unedited photo was posted, synced to a cloud album, sent in a message, or cached by a site, the redacted version is not the only copy. This is the most common way redactions fail, and it has nothing to do with the technique.

The file contains more than the picture

Layered project files can retain the original beneath the edit. Many PDF redactions place a black rectangle over text that remains selectable underneath. And EXIF metadata can carry GPS coordinates, timestamps and device identifiers that identify a subject regardless of how well the pixels were obscured.

Exporting from a canvas-based tool sidesteps the metadata problem, because the output is rebuilt from raw pixel values rather than copied from the source file. Our pixelate image tool works this way, and it also never uploads the photo in the first place.

A working checklist

• Solid shapes for anything with a finite set of possible values.
• Pixelation for faces, bodies and scenes, at a block size large enough that the subject is unrecognizable when you zoom out.
• Flatten and export to PNG or JPG. Never share the working file.
• Confirm the export carries no metadata from the original.
• Account for copies of the original that are already circulating.

For a fuller comparison of the three redaction methods, see pixelation vs blurring vs black bars.