Can a blurred photo be unblurred?

Partially, sometimes. Blurring is a mathematical operation, so if the exact operation is known it can be run backwards, and a lightly blurred image can give up a surprising amount. Heavy blurring is a different matter, because the process genuinely discards information rather than moving it around, and no amount of computation brings back what is not there. The practical rule: light blur is a hint, heavy blur is closer to a wall, and neither is a guarantee.

Can pixelated text be read?

Often yes, and this is the case people most underestimate. Pixelation averages each block of pixels down to one colour, and that average is a clue. If the font, size and background are known, software can generate candidate text, pixelate it the same way, and compare the result until it matches — a search rather than a reversal. Security researchers have published working tools that do exactly this. Never pixelate a password, an account number or an address.

Is blurring a face enough to protect someone's identity?

It depends entirely on how small the pool of candidates is. Reconstructing an unknown face from a blur is not realistic, because there is no way to search the space of all possible faces. But confirming whether a blurred face is one of a known handful of people is very achievable: blur each candidate the same way and compare. So for a stranger in the background of a holiday photo, a strong blur is reasonable. For someone whose identity could be narrowed to a short list, it is not.

Can AI restore a blurred or pixelated photo?

No, though it will confidently appear to. AI upscalers do not recover the original face, they invent a plausible one that would blur down to roughly the same pixels. Many different faces satisfy that condition, and the model picks whichever its training makes likely rather than whichever is true. A well-known demonstration turned a pixelated photo of Barack Obama into a white man. That makes AI unblur unreliable as recovery and actively dangerous as evidence.

What is the safest way to redact part of a photo?

Cover it with a solid block, applied destructively so the pixels underneath are actually replaced, and then check that nothing carries a second copy of the image. Better still, crop the sensitive part out of the frame entirely, because what is not in the file cannot be recovered from it by any means.

Why do redacted documents keep getting un-redacted in the news?

Almost never because someone reversed a blur. The usual cause is that the redaction was never destructive: a black rectangle drawn on top of text that is still selectable underneath, or an editing tool that saved the original data alongside the edited version. The information was in the file the whole time and simply had to be looked at rather than computed.

Can a blurred or pixelated photo be recovered?

Sometimes — but the failures that matter in practice are rarely mathematical, and usually mean the original was sitting in the file the whole time.

By Free Image Lab · July 31, 2026

The short answer

Three different questions get asked as one, and they have three different answers.

Can the blur be mathematically undone?: Partially, if it was light. Barely, if it was heavy. Blurring is a known operation and known operations can be run backwards, but a strong blur genuinely throws information away rather than hiding it.
Can the hidden content be guessed?: Very often, and this is the real risk. If the answer comes from a small set — a six-digit number, a name from a known list, a font you can identify — an attacker does not need to reverse anything. They can try every candidate, apply the same blur, and see which one matches.
Was the original still in the file?: Depressingly often, and this is how it actually goes wrong in public. No mathematics required.

What blur and pixelation actually do

Neither one deletes anything. Both replace each pixel with an average of its neighbours, and an average is a summary, not an erasure. Some of what went in is still represented in what comes out.

Blur replaces each pixel with a weighted average of the area around it. The larger the radius, the more pixels are folded into each result, and the less any individual one contributes.
Pixelation replaces each block with a single flat colour: the average of that block. A 10 × 10 block becomes one number instead of a hundred.

That framing explains the whole subject. Both are lossy summaries, so exact reversal is impossible in general — but a summary still constrains what the original could have been, and if the possibilities are few enough, a constraint is as good as an answer.

Text is the weak case, by a wide margin

Pixelated text is the single most over-trusted form of redaction, and the reason is that text has almost no variety in it.

A word is drawn from a small alphabet in a specific font at a specific size on a known background. So an attacker does not reverse the pixelation at all. They do this instead:

Guess a candidate string.
Render it in the same font, at the same size and position.
Pixelate it with the same block size.
Compare against the redacted image. Repeat until it matches.

This is a search, not a reconstruction, and searches are what computers are good at. Security researchers have published working tools built on exactly this method, recovering pixelated text from screenshots. The block size barely helps, because larger blocks slow the search rather than defeating it.

Never pixelate any of these

Passwords, account and card numbers, addresses, postcodes, licence plates, dates of birth, email addresses, reference numbers. Everything on that list is short, drawn from a small alphabet, and often checksum-verifiable — which means a wrong guess can be ruled out automatically, making the search faster still.

Faces are a different problem

The same attack does not transfer to a face, for a reason worth being precise about: there is no practical way to enumerate every possible human face. Reconstructing an unknown person from a heavy blur is not something anyone can do.

But the question is rarely “who is this, out of everyone alive”. It is usually “is this one of these people” — one of forty employees, one of the people known to have been at an event, one of a set of profile photos. That is a small set, and a small set can be tested one by one: blur each candidate the same way, compare, rank.

So the honest guidance is contextual rather than absolute:

A stranger in the background of a holiday photo, blurred hard, is fine. Nobody has a candidate list.
Someone whose identity could be narrowed to a short list by the context of the photo itself is not protected by blur, however strong. Use a solid block or crop them out.
Everything else in the frame still identifies people. A blurred face above a name badge, a distinctive tattoo, a house number or a car plate has not been anonymised at all.

What AI “unblur” actually does

Tools that promise to sharpen or restore a blurred photo are not recovering anything. They are generating.

The model produces a plausible sharp image that would blur down to roughly the pixels it was given. Enormously many different faces satisfy that condition, and the model returns whichever its training data makes likely — not whichever is true. The output looks specific and detailed, which is exactly what makes it misleading.

The well-known demonstration of this took a pixelated photograph of Barack Obama and produced a white man, because the model had learned which faces to expect. The system was not broken. It was doing what it was built to do, which is invent rather than recall.

Two consequences, pulling in opposite directions

AI upscaling is not a serious threat to a well-blurred face, because it cannot recover a person who was never in its input. But its output should never be treated as identification or evidence, because it is confident, detailed and unrelated to the truth.

How redaction really fails

Every case above is a maths problem. In practice, redaction almost always fails in a much duller way: the original never left the file.

The cover-up was drawn on top, not applied: A black rectangle placed over text in a document or PDF is an object sitting above the text, and the text underneath remains selectable, searchable and copyable. This is the classic published-document failure and it has nothing to do with image processing.
The editing tool kept the original: In 2023 a flaw in the screenshot editors shipped with Google Pixel phones and with Windows was found to leave the original data present in edited files, because the file was overwritten in place without being shortened. Screenshots that had been cropped or scribbled over could be partially restored — by people who did nothing cleverer than read the end of the file.
A second copy was hiding in the metadata: Photos frequently carry an embedded preview image inside the file, so software can show a thumbnail without decoding the whole picture. If an editor updates the main image but leaves that preview alone, the un-redacted version is right there, and it is not even hidden — any metadata viewer will show it.
The redacted copy was published alongside the original: Same folder, similar filename, or still sitting at the URL it was uploaded to before the edit. Unglamorous, and extremely common.

The pattern is consistent: the information was present the whole time and simply had to be looked at.

What to do instead

Crop it out if you can. The strongest redaction is the one where the data is not in the file. If the sensitive thing is near an edge, cropping beats every other option, and it cannot be undone by anyone.
Otherwise use a solid block, applied to the pixels. A flat fill is the only one of the three options that destroys the information rather than summarising it. Our blur and redact tool replaces the pixels rather than drawing over them, so the file you download contains nothing underneath.
Reserve blur and pixelation for what they are good at — making a photo look tidy while obscuring something nobody has a reason to attack. Not for text, numbers or anyone identifiable from a short list.
Check the metadata afterwards. Run the result through an EXIF viewer and look for an embedded preview, then strip it with remove EXIF metadata. While you are there, note that the GPS coordinates are usually still in the file too — blurring a face while publishing the location it was taken at is a poor trade.
Open the finished file and look at it. Zoom in on the redaction. Try to select the text. This trivial step would have caught most of the failures above.

One useful side effect

Redacting an image re-encodes it, which drops the metadata along the way — including the embedded preview and the GPS coordinates. It is one of the rare cases where the destructive option is the safe one.

Frequently asked questions

Can a blurred photo be unblurred?: Partially, sometimes. Blurring is a mathematical operation, so if the exact operation is known it can be run backwards, and a lightly blurred image can give up a surprising amount. Heavy blurring is a different matter, because the process genuinely discards information rather than moving it around, and no amount of computation brings back what is not there. The practical rule: light blur is a hint, heavy blur is closer to a wall, and neither is a guarantee.
Can pixelated text be read?: Often yes, and this is the case people most underestimate. Pixelation averages each block of pixels down to one colour, and that average is a clue. If the font, size and background are known, software can generate candidate text, pixelate it the same way, and compare the result until it matches — a search rather than a reversal. Security researchers have published working tools that do exactly this. Never pixelate a password, an account number or an address.
Is blurring a face enough to protect someone's identity?: It depends entirely on how small the pool of candidates is. Reconstructing an unknown face from a blur is not realistic, because there is no way to search the space of all possible faces. But confirming whether a blurred face is one of a known handful of people is very achievable: blur each candidate the same way and compare. So for a stranger in the background of a holiday photo, a strong blur is reasonable. For someone whose identity could be narrowed to a short list, it is not.
Can AI restore a blurred or pixelated photo?: No, though it will confidently appear to. AI upscalers do not recover the original face, they invent a plausible one that would blur down to roughly the same pixels. Many different faces satisfy that condition, and the model picks whichever its training makes likely rather than whichever is true. A well-known demonstration turned a pixelated photo of Barack Obama into a white man. That makes AI unblur unreliable as recovery and actively dangerous as evidence.
What is the safest way to redact part of a photo?: Cover it with a solid block, applied destructively so the pixels underneath are actually replaced, and then check that nothing carries a second copy of the image. Better still, crop the sensitive part out of the frame entirely, because what is not in the file cannot be recovered from it by any means.
Why do redacted documents keep getting un-redacted in the news?: Almost never because someone reversed a blur. The usual cause is that the redaction was never destructive: a black rectangle drawn on top of text that is still selectable underneath, or an editing tool that saved the original data alongside the edited version. The information was in the file the whole time and simply had to be looked at rather than computed.

Tools for this

Free, and everything runs in your browser.

← All guides