A blur that can be peeled off is not a blur
There are two ways software can hide part of an image, and they look identical on screen.
One draws the blur into the pixels. The original is overwritten and there is nothing underneath it any more.
The other keeps the original image and stores the blur as an instruction sitting on top. That is how a lot of document tools and some design apps work, and it means the hidden thing is still in the file. Anybody who opens it in the right software, or in some cases just changes the file extension and looks, gets the original back.
This exports a flat JPEG or PNG drawn from the canvas, so what you see is genuinely all that is there. It is worth checking how any tool you use behaves, because the failure is invisible and it is the whole reason people redact things.
Blur beats pixelation, and it is not close
Pixelation looks more deliberate and it is the weaker choice.
Averaging an area into blocks keeps a surprising amount of structure: the rough position of features, the relative brightness, the edges of things. Where the hidden content has only a limited number of possible answers, a number plate, a door number, a short word from a known set, that structure can be enough to narrow it down.
A generous blur destroys the information instead of rearranging it. If you do prefer the look of pixelation, use blocks far larger than feels necessary.
Turn it up further than looks right
Recognising a stranger takes a lot of detail. Recognising somebody you already know takes almost none.
A blur that still shows the shape of the eyes, the hairline and the set of the mouth will not stop a colleague, a neighbour or a family member identifying the person instantly. They are not working it out from the image, they are matching it against something they already have.
Keep going until the area is a smooth patch of colour with no structure left in it at all.
The face is rarely the only giveaway
Blur the face and the photo can still identify somebody completely.
A house number. A street sign in the background. A school uniform or a work logo. A distinctive car, or its plate. A name badge. A reflection in a window or a pair of glasses. A garden against a skyline that anybody local would place immediately.
Go over the whole frame before you export, not just the obvious bit. It is the background that usually does the damage.
The part almost everybody misses
A photo from a phone normally carries a block of information inside the file that has nothing to do with what the picture shows: the GPS coordinates where it was taken, often accurate to a few metres, along with the date, the time and the device.
Blurring a face does nothing to any of that. Somebody can have a completely anonymous image and the exact spot it was taken.
Anything exported from here is redrawn from the pixels, so that data does not come with it. But if you are sending the original file rather than an edited copy, strip it deliberately first.
Blurring after the fact is damage limitation
If the photo is already out there, replacing it with a blurred version helps with people who have not seen it yet and nobody else.
It does not reach anyone who already saved it, copies on other sites, forwarded messages, or cached versions. That is not a reason to skip it. It is a reason not to feel finished afterwards.
Common questions
Is a blur permanent, or can it be undone?
In the file you export here it is permanent, because the blur is drawn into the pixels rather than stored as an instruction to blur. That is the important distinction: some apps and some PDF tools save the original underneath and the blur as a layer on top, and anybody can peel it off. Once this exports a JPEG or PNG, the original pixels are gone from that file.
Should I pixelate instead?
No, blur is safer. Pixelation averages blocks of pixels and preserves quite a lot of structure, and for anything with a limited set of possible answers, a number plate, a house number, a short word, that structure can be enough to work backwards from. A generous Gaussian blur destroys the information rather than rearranging it. If you do pixelate, use very large blocks.
I already posted the photo. Does blurring it now help?
Only for people who have not seen it yet. Replacing an image does not reach anybody who already saved it, and it does not touch copies on other sites, in messages, or in a search engine cache. Blurring is worth doing anyway, but it is damage limitation rather than a fix, and there is no point pretending otherwise.
Does blurring a face make the photo anonymous?
Not on its own. A face is the obvious identifier and rarely the only one. A house number, a street sign, a school uniform, a distinctive car, a name badge, a reflection in a window, or the shape of a garden against a recognisable skyline will all identify somebody to a person who already half knows. Look at the whole frame, not just the faces.
What about the location stored inside the file?
That is the one most people miss entirely. A photo taken on a phone usually carries GPS coordinates, the date, the time and the device, embedded in the file itself. Blurring a face does nothing to any of that, and the coordinates are often accurate to a few metres. Anything exported here is redrawn from the pixels so that data does not survive, but if you are sending the original file somewhere, strip it first.
How much blur is enough?
More than looks necessary. A blur that still shows the shape of the eyes and mouth is a blur somebody who knows the person will see straight through, because recognising a familiar face needs far less information than recognising a stranger. Turn it up until the area is a smooth patch of colour with no structure left in it.
Does the unblurred original go anywhere?
No, which for this particular job is the whole point. You are here to remove somebody from a photograph before it goes out, so uploading the unblurred original to a stranger first is the one thing that would undo the exercise. It is opened, edited and saved in your browser, and the file that leaves your machine is the one you chose to save.