How to ai face pixelator that never uploads your video
- Step 1Open the tool (optionally go offline after load) — Load the page once; the app and FFmpeg.wasm/TensorFlow.js assets download. After that, processing itself doesn't need the network. Face pixelate requires the Pro-Media tier.
- Step 2Drop the sensitive video — Drag the file onto the drop zone. It's opened as a local object URL into an offscreen
<video>— no bytes are sent anywhere. The first run warms up the detector (Loading face detector). - Step 3Verify in DevTools if you need proof — Open the browser's Network panel before running. You'll see the one-time asset/model loads, then during processing no request carrying your video. The only call afterward is the small usage counter (no content).
- Step 4Set pixel size and padding for the content —
Pixel size(4–40, default 16) andPadding(0–1, default 0.25). For evidence/medical material that may be scrutinised, use a high pixel size (24–40) and padding 0.3+ so anonymisation is unambiguous. - Step 5Tune the sample rate to the footage —
Sample rate (Hz)(1–15, default 4). Static interview = 4 is fine; lots of movement = raise it so brief or moving faces are caught. - Step 6Run and download — file stayed local throughout — Detection then a single libx264 pass produce the MP4. At no point did the footage upload. Scrub to confirm coverage, then handle metadata/audio separately if the workflow requires it.
Where each part of the pipeline runs
Everything that processes your footage runs client-side. This is the privacy guarantee, grounded in the implementation.
| Step | Where it runs | Touches the network? |
|---|---|---|
| Reading the video | Local object URL → offscreen <video> | No |
| Face detection | TensorFlow.js on WebGPU/WebGL/CPU, in-tab | No (model loaded once at page load) |
| Clustering tracks | JavaScript in the tab | No |
| Mosaic encode | FFmpeg.wasm (libx264), in-tab | No |
| Usage counter | Single API call, no file content | Yes (optional; opt out in settings) |
Privacy-first settings and what they don't cover
Pixelation hides faces only. A fully-sanitised file usually needs more steps.
| Concern | This tool | Also do |
|---|---|---|
| Visible faces | Mosaiced (auto-detected, near-camera) | Manual misses → video redactor |
| Other on-screen PII (badges, screens, plates) | Not covered | video redactor |
| File metadata (GPS, device, date) | Untouched | metadata scrubber |
| Identifying audio (names, voices) | Copied unchanged | audio region muter |
Cookbook
Privacy-sensitive workflows where keeping the footage local is the whole point.
Prove to a client nothing was uploaded
A privacy-conscious client wants assurance. Show them the Network tab: model loads once, then no request carries the file during processing.
1. Open DevTools → Network, clear the log 2. Drop the video, run face-pixelate 3. Observe: no upload request with the video bytes 4. Only the small usage counter call (no content) appears Result: demonstrable client-side processing
Sanitise an HR interview recording end to end
An internal HR clip must hide the interviewee's face, their spoken name, and the file's device/date metadata — all without leaving the company laptop.
Step 1: face-pixelate (Pixel size 28, Padding 0.35) → face hidden Step 2: /video-tools/audio-mute-region → mute the name Step 3: /video-tools/metadata-scrubber → strip device + date All local, nothing uploaded See: /video-tools/solutions/silence-sensitive-audio-in-interview-video
Medical recording — strong, unambiguous mosaic
Patient-identifying footage. Use a high pixel size and padding so the anonymisation is clearly sufficient, and keep everything on-device.
Input: patient_recording.mp4
Settings: Sample rate 4, Pixel size 36, Padding 0.4
Result: heavy mosaic over the face, fully local
Note: verify no other identifiers (charts, badges) are in frame
→ cover those with video-redactorAir-gapped / offline use
Once the page and assets have loaded, the processing doesn't need the network. Disconnecting reassures you nothing can be transmitted.
1. Load the tool with network on (assets + model download) 2. Disconnect / go offline 3. Drop the video and run Result: processing completes offline (usage counter just queues/skips)
Evidence file for legal disclosure
Anonymise faces for a disclosure copy while keeping the footage on your machine the whole time. Use the legal evidence solution for the full chain.
face-pixelate → faces mosaiced locally Then: /video-tools/solutions/anonymize-video-file-before-evidence-share Nothing transmitted to a third party
Edge cases and what actually happens
A usage-counter request appears in Network
Expected (no content)The only network call during normal use is a usage counter for signed-in dashboard stats. It carries no file bytes — just a 'tool used' signal. You can opt out in account settings; the tool still works fully offline after the initial asset load.
Model/asset download on first load
Expected (one-time)On the first visit the app shell, FFmpeg.wasm, TensorFlow.js, and the MediaPipe model download. That's a one-time fetch of the tool itself, not your video. After it's cached, processing needs no network — you can disconnect and still run.
Pixelation doesn't sanitise metadata
Not coveredPrivacy-first means the footage stays local, but the output file still carries any metadata the source had (the encode writes a standard MP4). GPS, device, and date aren't stripped by pixelation — run the metadata scrubber for a fully sanitised file.
Audio still contains identifying speech
Preserved (audio copied)Audio is stream-copied unchanged, so a name or recognisable voice remains. For sensitive material mute the relevant spans with the audio region muter — pixelating the face alone isn't full anonymisation if the voice identifies the person.
Non-face identifiers in frame
Not coveredBadges, ID cards, on-screen documents, tattoos, and license plates aren't faces and won't be mosaiced. Cover them manually with the video redactor for a complete sanitisation pass.
No faces detected
Error: no facesIf the detector finds nothing, the run throws No faces detected. For sensitive footage where a face is clearly present but small or in profile, don't conclude it's clean — raise the sample rate or redact manually.
CPU fallback on a machine without WebGPU/WebGL
Slower (still local)If neither WebGPU nor WebGL is available, TensorFlow.js falls back to CPU. Detection is much slower but still runs entirely in-browser — the privacy guarantee is unchanged; only speed differs.
Tier gate
Tier requiredFace pixelate is Pro-Media or higher. Free (1 GB / 1 file) and Pro (10 GB / 5 files) cannot run it. Pro-Media: 100 GB / 50 files; Developer: 100 GB / unlimited. The tier gate is about plan, not about where processing happens — it's always local.
Frequently asked questions
How do I know my video isn't uploaded?
Open your browser's DevTools Network panel before running. You'll see one-time asset and model downloads (the tool itself), then during processing no request carries your video bytes. Detection runs in TensorFlow.js and encoding in FFmpeg.wasm, both in the tab. The only call afterward is a usage counter that contains no file content.
Can I use it fully offline?
Yes, after the first load. Once the app, FFmpeg.wasm, TensorFlow.js, and the MediaPipe model are cached, processing needs no network. You can disconnect and still detect and mosaic faces; the optional usage counter simply doesn't fire.
What is the one network call I might see?
A usage counter for signed-in dashboard stats — a 'tool was used' signal with no file content. It exists so your dashboard can show how many files you've processed. You can opt out in account settings without losing any functionality.
Is this suitable for legal or medical footage?
The architecture (no upload, in-browser detection and encode) is designed for footage you can't transmit to a third party. For a complete sanitisation, also strip metadata with the metadata scrubber, mute identifying audio with the audio region muter, and cover non-face PII with the video redactor. This isn't legal advice — confirm requirements for your case.
Does the output file still have my original metadata?
The encode writes a fresh MP4, but you should not assume it's metadata-clean. Pixelation targets pixels, not metadata. For a verifiably sanitised file run the metadata scrubber afterward to strip GPS, device, and date fields.
What about the audio — is the voice anonymised?
No. Audio is stream-copied unchanged. A recognisable voice or a spoken name still identifies the person. For sensitive footage, mute those spans with the audio region muter — pixelating the face alone is incomplete if the audio leaks identity.
Does it send my face data to a cloud AI model?
No. The MediaPipe FaceDetector model runs locally in TensorFlow.js inside your tab. There is no cloud inference call — the model is downloaded once and then executes on your device's GPU (or CPU). No biometric data is sent anywhere.
What if my machine has no WebGPU?
TensorFlow.js falls back to WebGL, then to CPU. Detection still runs entirely in-browser; it's just slower on CPU. The no-upload privacy guarantee is identical regardless of backend — only the speed of the detection stage changes.
What output format and quality do I get?
An MP4 (H.264, yuv420p, CRF 20, +faststart) with audio copied. The whole frame is re-encoded at near-lossless quality; only the detected face regions change. If you need a different container, transcode locally with the video transcoder.
Does it cover non-face identifiers like badges or screens?
No — it mosaics detected faces only. ID badges, on-screen documents, license plates, and similar are ignored. Cover them with the video redactor, which lets you draw fixed mosaic/blur regions by hand for a complete pass.
How strong should the mosaic be for sensitive material?
Use a high Pixel size (24–40) and Padding (0.3–0.4) so anonymisation is clearly sufficient and no facial structure survives. For material that may be scrutinised (evidence, medical), err toward the maximum block size and verify the result frame-by-frame.
Which plan do I need?
Pro-Media or higher. Face pixelate is gated on Free and Pro. Pro-Media: 100 GB / 50 files; Developer: 100 GB / unlimited. The plan gate is independent of the privacy model — processing is always local on every tier that can run the tool.
Privacy first
Every JAD Video tool runs entirely in your browser via WebCodecs and FFmpeg (WebAssembly). Your video files never leave your device — verified by zero outbound network requests during processing.