How to pixelate patient faces in clinical and teaching video
- Step 1Open the tool — it lands on the video face pixelator — The bulk face pixelator routes to the JAD video pixelate engine at /video-tools/face-pixelate, which takes a single clinical recording and mosaics every face it detects across it. If your asset is a single still clinical photograph, this engine needs a decodable video stream and will report 'Source has no video stream' — de-identify one still with an image redactor instead.
- Step 2Drop ONE recording — keep it local — Drag a single video onto the tool (no folder, no batch). A telehealth screen-recorded
.webm, a clinic camera.mp4, or a phone.movloads through the browser's<video>element; a non-standard codec gives 'Could not load source video for face detection.' Because everything runs locally, the patient recording stays on the machine. Watch your tier's security file limit (Free 10 MB; Pro 100 MB; Pro-media 500 MB; Developer 2 GB) — the video face-pixelate engine is a Pro-media tier feature. - Step 3Set Sample rate for limited clinical movement — Sample rate (1–15 Hz, default 4) is how many frames per second are inspected. A seated consultation where the patient barely moves is well covered at 4–5 Hz. If the patient turns the head during an exam or a procedure, raise it to 6–8 Hz so the turning face keeps accumulating detections. Detection time scales roughly with sample rate; 15 Hz is the maximum.
- Step 4Set Pixel size for a clean teaching look — Pixel size (4–40, default 16) is the mosaic block size — each face crop is scaled down by this factor with nearest-neighbour sampling then back up. For teaching material 16–24 reads as cleanly de-identified on a projected slide. Avoid 4–8, which can leave recognisable facial structure — unacceptable for patient de-identification; go to 28–36 if the clip is especially sensitive.
- Step 5Set Padding to hide re-identifying features — Padding (0–1, default 0.25) grows each detected box outward before pixelation, covering hairline, jaw, and ears — features that can re-identify a patient even when the central face is masked. Raise it toward 0.4 for a profile or partly-turned head during an exam. Keep it lower if a clinician and patient are close together and you don't want the mosaics to merge.
- Step 6Run, then review the whole clip before teaching use — Press run. You'll see 'Loading face detector (one-time WebGPU + model warm-up)', then 'Detecting faces · sample n/N', then 'Pixelating faces · k faces'. When the
.mp4downloads, review the entire recording — BlazeFace short-range is weakest on profiles, motion blur, and faces partly hidden by equipment, masks, or drapes, and only the 12 most-detected tracks are kept. Note the clinician's face is also mosaicked if detected, since there's no per-face selection. Any frame where the patient is exposed must be manually redacted. Use a region redactor for non-face identifiers like a wristband, a chart, a screen with the patient's name, or a tattoo.
Settings starting points for clinical footage
Only three controls exist — no sensitivity slider, no per-face toggle, no blur-strength (that's the separate face-blur tool). Practical starting values for clinical recording conditions, all within the real ranges.
| Recording type | Sample rate | Pixel size | Padding |
|---|---|---|---|
| Seated consultation, little movement | 4 Hz | 20 | 0.30 |
| Telehealth screen recording | 5 Hz | 20 | 0.30 |
| Exam where patient turns head | 8 Hz | 20 | 0.40 |
| Procedure with face partly occluded | 8 Hz | 24 | 0.45 |
| Highly sensitive context | 6 Hz | 32 | 0.40 |
Pipeline behaviour and clinical blind spots
What the engine does when you press go, plus the model limits that matter most for patient de-identification. Browser path and local JAD Runner use the same BlazeFace short-range model and nearest-neighbour mosaic.
| Aspect | Behaviour | Clinical implication |
|---|---|---|
| Where it runs | In-browser (TFJS WebGPU/WebGL/CPU) or local JAD Runner | Patient footage never reaches a third-party processor |
| Detection model | BlazeFace short-range, confidence fixed at 0.5 | Masks, oxygen lines, drapes, and equipment over the face cause misses |
| Tracking | IOU-clustered (0.2) spatial tracks across sampled frames | A patient who shifts position still gets one continuous mosaic window |
| Per-face selection | None — every detected face is mosaicked | The clinician's face is also covered if detected; can't keep one and hide the other |
| Track cap | Keeps only the 12 most-detected tracks | Rarely an issue in a one- or two-person consult; relevant in group settings |
| Output | Single H.264 .mp4, irreversible mosaic | Drop straight into a deck / LMS; no recoverable original |
Cookbook
Walk-throughs grounded in what the engine actually does on clinical footage — one recording in, mosaic MP4 out. Stage labels are the real progress messages.
Seated consultation for a teaching slide
A static consultation clip. Both patient and clinician faces are detected and mosaicked; default-ish settings de-identify cleanly.
Source: consult.mp4 (1080p, 3 min) Controls: Sample rate 4 Hz · Pixel size 20 · Padding 0.30 Progress: Loading face detector (one-time WebGPU + model warm-up) Detecting faces · sample 721/721 Pixelating faces · 2 faces · 180.0s / 180.0s Output: consult-pixelated.mp4 (H.264) Note: there is no per-face toggle, so the clinician is also mosaicked. If the clinician must stay visible, use a manual region redactor over the patient instead.
Patient turns the head during an exam
An exam where the patient rotates the head; at the default rate the mosaic lags the turn. Raise the sample rate and padding so the turning face stays covered.
Problem at default: Head turn happens between 4 Hz samples -> mosaic lags / drops Fix: Sample rate 8 Hz -> turn is sampled more often Padding 0.40 -> wide margin keeps profile covered mid-turn Reality: a hard side profile may still be under-detected -> scrub for any frame where the box dropped and manually redact.
Face partly hidden by a mask or equipment
A procedure clip where a mask, tubing, or drape covers part of the face. The short-range model under-detects occluded faces; combine higher sample rate and heavy padding, then verify.
Source: procedure.mp4 Controls: Sample rate 8 Hz · Pixel size 24 · Padding 0.45 Reality check: Occlusion (mask / tubing / drape) reduces detection. Some frames detect, some do not. Padding 0.45 keeps coverage wide where a face is found. Mandatory: review the whole clip; manually redact any frame where the patient is identifiable but the mosaic dropped.
Non-face identifiers also need redacting
A face detector only finds faces. A wristband, a chart, an on-screen patient name, or a distinctive tattoo are not faces and won't be touched.
In frame, also identifying the patient: - ID wristband - paper chart / monitor with name + MRN - distinctive tattoo This tool will NOT redact those (not faces). Use the manual region redactor and draw a rectangle over each for the time it is visible, before teaching use.
Source is a single clinical still, not a recording
This engine is the video pixelator and needs a decodable video stream. A still image is rejected.
Input: clinical-photo.jpg
Result: error -- "Source has no video stream"
(browser path: "Could not load source video")
Fix options:
- Wrap the still in a 1-2s clip, then pixelate
- Use an image/region redactor for a single clinical photoEdge cases and what actually happens
Pixelation cannot be undone
By designEach face crop is scaled down with nearest-neighbour sampling and scaled back up, discarding the detail — there is no key or reverse pass. For patient de-identification that's required: the teaching copy has no recoverable original. Keep the identifiable master only in your governed clinical store.
Every detected face is mosaicked — including the clinician
ExpectedThe engine has no per-face on/off; it mosaics every face it detects, so the clinician's face is also covered if it's in frame. If the clinician must remain visible and only the patient hidden, this tool can't do selective redaction — use a manual region redactor over the patient instead.
It opens the video tool, not a batch tool
ExpectedChoosing the bulk face pixelator redirects to /video-tools/face-pixelate, which processes one recording and tracks faces across its frames. It is not a multi-file uploader. Process each clinical clip individually.
Nothing is uploaded
By designDetection runs in your browser (TFJS WebGPU/WebGL/CPU) and the mosaic is encoded with ffmpeg.wasm, or locally on the JAD Runner in headless Chromium. Patient footage never reaches a third-party processor, which is the non-negotiable requirement for clinical material.
No faces detected
No facesIf no sampled frame yields a face, you get 'No faces detected. Try a lower sample rate or a clearer source.' In clinical footage this often means a mask, drape, or equipment occluding the face, or a hard profile. Raise the sample rate, supply a clearer copy, and manually redact what the near-frontal model can't catch.
Faces found but not grouped into a region
No tracksDetections existed but clustering produced no usable track ('Faces detected but could not be grouped into redaction regions'). Sparse single-frame hits — a patient who momentarily faces the camera — at a low sample rate cause this. Raise the sample rate so detections accumulate into a coherent track.
Face at frame edge drops below minimum size
No regionsAfter padding, clamping to the frame, and rounding to even dimensions, an edge box can shrink below the 4-pixel minimum and be skipped; if all do, you get 'Detected faces fell outside frame after clamping.' Lower the padding, or reframe if you control the camera, and manually check the patient near frame edges.
Masks, drapes, and equipment cause misses
Detection limitBlazeFace short-range is tuned for clear near-frontal faces. A surgical mask, oxygen tubing, drape, or hard profile makes detection unreliable regardless of settings. Padding helps only once a detection exists — review the recording and manually redact any frame where the patient remains identifiable.
First run warms up before any face appears
ExpectedThe detector model, WASM graph, and (on WebGPU) shaders compile on first use, shown as 'Loading face detector (one-time WebGPU + model warm-up)'. This one-time cost happens before sampling; later runs in the same session reuse the cached detector.
Output is always MP4
SupportedWhatever the input container (.mov, .webm, etc.), the result is an H.264 .mp4 — fine for a lecture deck, LMS, or conference submission. There's no option to keep the original container; re-mux afterward if your platform needs another format.
Frequently asked questions
Can I hide the patient but keep the clinician visible?
No — this engine mosaics every face it detects, with no per-face on/off, so the clinician is also covered if in frame. To keep the clinician visible and hide only the patient, use the manual region redactor at /video-tools/video-redactor to blur the patient's region for the time they're on screen.
Does patient footage get uploaded anywhere?
No. Detection runs in your browser via TensorFlow.js (WebGPU, then WebGL, then CPU) and the mosaic is encoded with ffmpeg.wasm, or locally on the JAD Runner in headless Chromium. The recording never reaches a third-party processor — the key requirement for clinical material.
Is the de-identification irreversible?
Yes. Each face is downscaled with nearest-neighbour sampling and scaled back up, permanently destroying the detail — there is no key or reverse pass. The teaching copy has no recoverable patient face. A soft blur can sometimes be partly recovered; a sensible-size mosaic cannot.
Is this enough to make the clip HIPAA-safe for teaching?
Face pixelation removes one identifier, but a face is not the only one. You must also redact wristbands, charts, on-screen names/MRNs, tattoos, and spoken identifiers, follow your organisation's de-identification policy, and confirm consent. This tool handles faces in video; the rest is your governance process. It is not legal or compliance advice.
How do I redact a wristband, chart, or on-screen patient name?
Those aren't faces, so the detector won't find them. Use the manual region redactor at /video-tools/video-redactor to blur each rectangle for the time it's visible, and mute spoken names with /video-tools/audio-mute-region.
Why did the mosaic drop when the patient was masked or turned?
The near-frontal short-range model under-detects occluded faces and hard profiles. Raise the Sample rate to 8 Hz and Padding to about 0.45 to widen coverage when a face is found, then review and manually redact any frame where the patient is still identifiable.
How blocky should the mosaic be for a teaching slide?
Use Pixel size 16–24 for a clean, professional de-identified look on a projected slide. Avoid 4–8, which can leave facial structure recognisable. Go to 28–36 for especially sensitive contexts.
Does it work on a single clinical still photo?
No — this is the video engine and needs a decodable video stream. A still is rejected with 'Source has no video stream'. For one photo, wrap it in a short clip or use an image/region redactor.
Is there a confidence slider to catch more faces?
No. The only controls are Sample rate, Pixel size, and Padding; detection confidence is fixed at 0.5. To catch more, raise the sample rate or use a clearer recording — and manually redact what the near-frontal model can't see.
What format and tier do I need?
Output is always a single H.264 .mp4. The video face-pixelate engine is a Pro-media tier feature; Pro-media (500 MB) is also realistic for a full session. Free is 10 MB, Pro 100 MB, Developer 2 GB — one video at a time.
Can I trust it to catch the patient automatically every time?
No automated detector is complete. Masks, equipment, profiles, motion blur, and small/distant faces are missed, and only the 12 most-detected tracks are kept. Always review the full recording and manually redact any frame where the patient is identifiable before teaching use — the tool assists review, it doesn't replace it.
Should I pixelate or blur, and what about metadata?
Pixelate (this tool) is irreversible and reads as deliberately de-identified — the safer choice for patient material. A softer blur is at /video-tools/face-blur. Strip device/GPS metadata afterward with /video-tools/metadata-scrubber so the file doesn't leak the clinic's location or capture device.
Privacy first
Every JAD Security operation runs entirely in your browser. Files, passwords, and PGP private keys never leave your device — verified by zero outbound network requests during processing.