Can blurred faces and number plates be recovered?

We blurred 12 number plates until each was a yellow smear, then got every one back. The method needed no deblurring and no AI: we blurred a list of 2,000 possible plates the same way and picked the one that matched best. It found the right plate 12 times out of 12, at every blur and pixelation strength we tried, including ones far heavier than anyone would choose for a photo.

So for number plates, names, addresses and any other text, use a solid box. Blur and pixelation are for making a face less distracting, not for keeping anything secret. The tests below were run on 24 September 2026 in Chromium 153 with the same code as our Blur faces and number plates tool.

Blurred number plates came back every time

We drew 12 made-up plates in the UK format (two letters, two digits, three letters) in a bold fixed-width font on a yellow background, at two sizes, 64 and 32 pixels tall. Each one was hidden with the tool’s own blur or pixelation and saved as a quality 90 JPG, like a download from the tool.

Then we tried two ways of reading them back. The first assumed a list: 2,000 plates including the real one, each hidden the same way, compared pixel by pixel with the saved image. The second assumed no list at all. It guessed one character at a time, left to right, keeping the six best partial guesses at each step.

The list attack never missed. Our heaviest blur had a spread (sigma) of 38 pixels on a plate 64 pixels tall; you could not tell it was a plate. It still matched. With no list, the character-by-character guess read every plate hidden at our tool’s light and medium settings and at strong pixelation, and got 4 of 12 through our strong blur.

A list is less far-fetched than it sounds. If someone knows the make of car and the town, or the handful of names that could be on a badge, the list is short. This is the idea behind Depix, a public tool that recovers text from pixelated screenshots by pixelating known text and matching blocks.

A solid box is different in kind. Every guess, hidden under the same black rectangle, gives exactly the same pixels, so there is nothing to compare. We checked the tool’s output on a lossless PNG: every one of the 1,019,672 pixels it changed was pure black, and no other pixel in the photo moved.

What faces keep

Faces don’t come with a short list, so we measured what’s left instead, on eight public-domain official portraits of members of the US Congress. Two checks: does our own face finder still see a face after the treatment, and how similar is the treated face to the original (SSIM, where 1 is identical)?

Light pixelation and light blur leave something a face finder still recognises as a face in almost every portrait, and skin tone, hair colour and the shape of the head were still plain to see at every blur and pixelation strength. The one “face” found under a solid box was the black oval itself, called a face at 63% confidence for its head-like shape; that tells you about the detector, not about anything left in the pixels.

We didn’t try to recognise who each person was. A 2016 paper, Defeating Image Obfuscation with Deep Learning, did: its neural networks recognised faces hidden by pixelation and by blurring. Treat a blurred face as a face that people who already know the person may still recognise.

The copy inside the file

Many photos carry a second, smaller picture inside them: an EXIF preview thumbnail written by the camera or the editing app. Five of the 17 public photos we downloaded for these tests had one. The group photo we tested the face finder on carries a 256 by 158 pixel preview of the whole unblurred group. An editor that blurs the main picture and keeps the original metadata keeps that preview too. Our tool saves a new file from the edited pixels with no EXIF at all; exiftool found no thumbnail and no camera data in the saved copy.

What we’d use

A solid box for plates, text, badges, screens and documents, every time. For faces in a photo you’re posting publicly, a solid box too if the person could be at risk from being identified. Pixelation or blur only where the point is to make a face less prominent, not to make it unknowable, and then the strong setting: at light settings our own face finder still saw the face in 7 or 8 of 8 portraits.