Which files do I need?

favicon-32.png with a 32x32 size attribute, and apple-touch-icon.png at 180x180. A 16px fallback covers older browsers.

Can I use a photo as a favicon?

It will be unreadable at 16 pixels. Simple marks with strong contrast survive the resize; photos do not.

Yes. The image is resized in your browser and never uploaded.

Pick an image and download it resized to 16, 32 and 180 pixels, the sizes browsers and phones use. Runs in your browser; nothing is uploaded.

PNG output works everywhere. For SVG favicons, draw one or use this as the fallback set.

Serve all three with link tags in the head and every browser picks the right one.