2026-08-09

What should you actually blur in a photo before you post it?

Before you post that photo — a boarding pass for a humble-brag, a marketplace listing with your car in the driveway, a group shot from last night — a few square inches of it are doing more work than you'd like. None of this is hypothetical: each example below is a real, documented case of a photo detail getting used for something the person posting it never intended.

The boarding pass that gave away a stranger's whole account

Security researcher Brian Krebs has documented, and CBS News has reported on, exactly how much a boarding-pass barcode actually encodes: full name, frequent-flyer number, and the record locator — the booking reference an airline's own site uses to pull up a reservation. In one documented case, that was enough on its own: scanning the barcode from a photo, then plugging the name and record locator into the airline's website, opened the stranger's account outright — full itinerary, contact details, the works. It's not a hypothetical worst case; it's what actually happened when someone tried it.

The face a stranger's search engine can find

It isn't only your own face that matters here, either. NPR's October 2023 investigation into PimEyes — a public reverse face-search engine — found it powerful enough that its own testers' faces reliably surfaced matches across the web, including photos they didn't know were online. The concern researchers and journalists have raised isn't limited to people deliberately searching for themselves: the same tool can identify a stranger caught in someone else's public photo — a face in the background of a group shot, a bystander at an event — from nothing but that face. PimEyes' own CEO put the number of confirmed misuse cases at "a few hundred" in that reporting; privacy researchers quoted in the same piece argue that figure almost certainly understates how the tool actually gets used, since there's no way to audit a search after the fact.

Even Google blurs this automatically, and not as an afterthought

The same two details — faces and license plates — are exactly what Google's own Street View cars are required to obscure. Google's official Street View privacy policy states that automatic face- and license-plate-blurring is applied to every published Street View image, with an additional request-based option to blur an entire car, house, or person on top of that default. That's the standard Google set for photographs it captures itself, at a scale of hundreds of millions of images — a strong signal that the same two details are worth handling deliberately in the one photo you're about to post yourself.

Why a soft blur isn't the same as actually hiding something

A quick blur filter — the kind built into a lot of photo editors — softens edges; it doesn't erase the pixel data underneath. That distinction is exactly why the boarding-pass research above is worth reading closely: it specifically found that minor obstructions — a light blur, a partial crop, a sticker over most (not all) of a barcode — aren't reliable, because a barcode scanner only needs a clean read of the underlying pattern, not a version a human finds hard to read. The same logic applies to a face or a plate blurred just enough to look "fixed" at a glance. The reliable fix for something that actually needs to disappear is pixelation: dividing the region into blocks and replacing each block with a single averaged color, so the original detail isn't dimmed — it's discarded. That's the difference between harder to notice and not recoverable.

How to actually pixelate part of a photo before you post it

NearIMG's Blur tool is built around exactly that distinction, not a single blur-strength slider applied to the whole image. Open a photo, and drag a box directly over each region that needs to disappear — a barcode, a face, a plate, an address on an envelope — with the mouse, or with arrow keys plus Enter if you're using a keyboard. Each region gets pixelated at a block size scaled to that region, so a small face and a large sign both come out clearly obscured rather than faintly softened, and you can mark as many separate regions on one photo as you need, with an undo and a clear-all if you change your mind before applying. Nothing is uploaded — decoding the photo, drawing the boxes, and the pixelation itself all happen in your browser — and once you apply it, the pixelated area is baked permanently into the exported image, not layered on top of it, so there's no hidden "unblur" step left sitting in a file for someone else to undo.

What this fixes — and what it doesn't

What it fixes is exactly the visible-pixel problem described above: once a region is pixelated and the image is exported, that detail is gone from what anyone looking at the photo can actually see. What it doesn't touch is a separate, invisible layer — a photo's own file metadata, like GPS coordinates a camera or phone may have written into the file alongside the pixels. That's a genuinely different problem from what's visible in the frame, and not what a pixelation tool is built to solve, though as a side effect, redrawing an image onto a canvas and exporting it — which is how the Blur tool, and every other tool in NearIMG, produces its output — doesn't carry the original file's metadata forward at all, since a canvas only ever holds pixel color data, not the metadata fields a camera writes into the file next to them. And it can only pixelate what you tell it to: it won't scan a photo and find the barcode or the stranger's face on its own — spotting it is still on you.

The short version

A boarding-pass barcode, a stranger's face, and a license plate have each been documented, by a named security researcher, a national news investigation, and Google's own stated policy respectively, as details worth deliberately obscuring before a photo goes anywhere public. A light blur softens them; it doesn't reliably destroy what a determined scanner, search engine, or viewer can still get out of them. Pixelating the specific region — the way NearIMG's Blur tool does, entirely in your browser, before the file ever reaches a server — is the version of "blurred" that actually means gone.