How PixelatePhotos works

1. Your picture is decoded in the tab

The browser decodes the file and applies its orientation, so a sideways phone photo looks right. Pictures larger than 8192 px on the long edge are scaled down to that size; the editor shows the original and working sizes when it does. Nothing is sent anywhere — there is no server behind this site to send it to.

2. Regions are rasterised into coverage

Rectangles and ellipses are measured analytically, lassos are filled scanline by scanline, brush strokes are the union of round-capped segments, and the person finder's mask is scaled up smoothly. Each region becomes a coverage value from 0 to 255 for every pixel it touches; ellipses fade over about a pixel at their edge, rectangles are hard-edged so a redaction box covers right up to its border.

3. The style is computed from the original pixels

• Square pixels: the grid is anchored to the whole picture, and every block is the alpha-weighted mean of all pixels inside it. Regions that touch share one continuous grid.
• Hex mosaic: each pixel is assigned to a pointy-top hexagon by cube-coordinate rounding; each hexagon gets its pixels' mean.
• Crystallize: one seed per grid square at a random position; each pixel joins its nearest seed (a Voronoi diagram); each cell gets its mean.
• Blur: three box-blur passes in each direction, which closely approximates a Gaussian.
• Solid bar: an opaque fill in black, white or grey.

4. Safety mode

With safety on (the default on hiding tools), three things happen. A hidden region never gets more than 10 blocks across its short side, so a face can't be pixelated so finely that it stays recognisable. Each block's colour gets a small random offset, and the grid starts at a random position; both come from your browser's cryptographic random source and are never saved. Together they remove the exact block averages that depixelation attacks compare against.

For text, even that is not a promise worth making: pixelated text has been recovered by rendering candidate words in the same font and comparing. The redactor therefore defaults to solid bars.

5. Export writes a new file

The final picture is rendered again at full size and encoded by the browser as PNG, JPG or WebP. That encoder writes pixels only — no EXIF, GPS, camera or software tags, no layers and no original underneath.

6. Pixel art

The photo is reduced to the chosen number of pixels across with an exact area-weighted average, nudged in contrast and saturation, then mapped to a palette: one of eight retro sets, or colours picked from the photo by median cut or k-means. Dithering (Floyd–Steinberg, Atkinson or Bayer) is optional, as is an ink outline along strong edges. Upscaled exports use nearest-neighbour at whole-number factors so every pixel stays square.

7. On-device AI, only when you ask

Three open models can be downloaded from our model file server. Each is fetched the first time you press its button, kept in your browser's cache, and run on your device with ONNX Runtime Web (WebGPU where available, otherwise WebAssembly). The runtime itself is served from this site.

• Face finder (YuNet) — 224 KB, MIT licence, from the OpenCV model zoo.
• Person finder (PP-HumanSeg) — 5.9 MB, Apache-2.0 licence, from the OpenCV model zoo (PaddleSeg).
• Enhancer (Real-ESRGAN general x4v3) — 4.6 MB, BSD-3-Clause licence, from the Real-ESRGAN project.

See them in use: pixelate a face, pixelate the background, enhance a blocky picture.