Do it yourself

How to run Fawkes yourself, free

Fawkes is free, open source, and made by the University of Chicago SAND Lab researchers who invented this technique. If you have a terminal and an evening, this is the route we would recommend — including over paying us.

Before you start

Running it locally means your photograph never leaves your computer. That is a real advantage over every hosted service, this one included, and it is the honest reason to prefer this route. What it costs you is setup time and patience: cloaking is compute-bound, so a laptop CPU takes minutes per image rather than seconds.

It is worth knowing before you invest the evening that this protects the file you cloak, going forward. It does nothing about copies of your face already published and indexed — that is a removal problem, not a cloaking one.

  1. 1

    Get it

    Two routes. The standalone binary for Windows, macOS or Linux from the SAND Lab page needs no Python at all and is the right choice if you are not already set up for it. The Python package is better if you want to script it or handle many images.

  2. 2

    Pick a protection mode

    The modes trade cloak strength against visible artifacts. Start with low. Artifacts appear first on large flat areas — skin, a plain background — at high zoom, and on a professional headshot a cloak nobody notices is worth more than a stronger one people can see.

  3. 3

    Point it at a directory

    It works on a folder of images rather than one file at a time. The first run also downloads the feature-extractor model weights before it can begin, so allow extra time for that once.

  4. 4

    Wait

    Minutes per image on a CPU. A GPU is considerably faster but is not required, and most people run this on a laptop without one. If it appears to hang on the first run, it is almost certainly still fetching weights.

  5. 5

    Publish the cloaked file, keep the original

    Fawkes writes a new file next to each original rather than modifying it in place. Upload that one. Keep the original somewhere private — it is the un-cloaked reference, and one public copy of it anywhere undoes the work.

# Roughly what the local workflow looks like.
# Check the SAND Lab page for current flags and releases.

pip install fawkes
fawkes -d ./my-photos -m low

# Writes ./my-photos/<name>_cloaked.png next to each original.

Fawkes, at the UChicago SAND Lab — the source of truth for current releases and flags. Where this page and that one disagree, that one is right.

What running it perfectly still will not do

Recompression degrades it. Every platform resizes and re-encodes photographs on upload, and the perturbation lives in exactly the fine detail compression discards. Upload the cloaked file directly rather than a screenshot or a re-export, and expect the platform to re-encode it regardless. This is a limitation of the whole category, not of Fawkes.

One clean copy defeats it. If the original is public anywhere — an older profile, a company bio, a colleague’s post — an indexer has an un-cloaked reference and the cloaked file does not help.

It is not permanent. Detection is plausible in principle, since the perturbations follow patterns a system expecting them can look for, and reversal is an active research area. Treat cloaking as raising the cost and unreliability of matching rather than guaranteeing anything. The researchers who built these tools say the same.

When paying for a hosted run makes sense

One photo, handled in about a minute, in a browser, on a machine that is not yours to configure — no Python environment, no model weights, no waiting on a laptop fan. That is the whole of what a hosted service buys you, and it is worth being clear that it is convenience rather than better protection.

It also costs you something real: a copy of your photo exists on someone else’s server, at least briefly. We delete the original and the output after processing and do not require an account for a single photo, but on that specific axis running it locally is strictly better.

Cloak one photo in a browserOn a phone?

FAQ

Frequently asked questions

Do I need a GPU?

No, but it helps a great deal. Fawkes runs on a CPU and most people run it that way. Expect minutes per image rather than seconds, and expect the first run to be slower still because it downloads the feature-extractor weights before it can start.

Which protection mode should I use?

Low, unless you have a specific reason not to. The modes trade protection strength against visible artifacts, and the artifacts show up first on large flat areas — skin, a plain background — at high zoom. For a professional headshot, a cloak nobody notices is worth more than a stronger one people can see.

It finished but the photo looks identical. Did it work?

That is the intended result. The perturbation is designed to sit below the threshold of ordinary human perception, so a cloaked file that looks obviously altered would be a worse outcome, not a better one. Check that the tool wrote a new file — it does not modify the original in place.

Should I delete the original?

Do not delete it, but do not publish it either. Keep it somewhere private. The original is the un-cloaked reference, and a single public copy of it anywhere undoes the work, because an indexer will happily use that one instead.

Why would I pay for a hosted version when this is free?

For most people with a terminal and an evening, you should not — running it locally is free, it is from the researchers who invented the technique, and your photo never leaves your machine, which on privacy specifically is strictly better than any hosted service including ours. Paying makes sense when you want one photo handled in about a minute without installing a Python environment and downloading model weights.