How to redact a screenshot before you share it.

What leaks in screenshots

Most leaks are not the thing you meant to show. They sit at the edges of the frame:

Names and emails

Account menus, comment threads, sidebars and "shared with" lists show who you work with.

Keys, tokens and passwords

Settings pages, terminals, browser dev tools and .env files on screen. One visible key is enough to misuse it.

Customer data

Dashboards, CRM rows, support tickets and order lists carry other people’s details, not just yours.

Internal URLs and tab titles

The address bar, other open tabs and bookmarks can reveal project names, staging hosts or private docs.

Notifications

A message preview that lands while you capture ends up in the image.

File paths and usernames

Paths like /Users/yourname/ and window titles give away more than the content you meant to show.

Blur is not the same as gone

There are three common ways to hide part of a screenshot, and they are not equally safe.

Overlays can be peeled off. A blurred or semi-transparent shape drawn on top of an image, in a design file, a PDF or a slide, still has the original underneath. Anyone with the source file can move it.

Fine pixelation of text can be reversed. Pixelation replaces each block with its average color. When the blocks are small and the text uses a common font, the averages carry enough of the shapes to guess the letters. Public tools do exactly that: Depix recovers text from pixelized screenshots, and Bishop Fox’s Unredacter (2022) reversed a pixelated sample and concluded that solid black bars are the only safe way to redact text.

Removal is the strongest. If the sensitive part is cropped out, or covered with a solid fill and re-saved, there is nothing left to recover.

So: crop secrets out, or cover them with a solid bar. Use coarse pixelation only for things like names or avatars that you need to keep in the layout, and make sure it is baked into the pixels of the exported file.

Cropping can leak too

An edited image is only safe if the file is written from scratch. In 2023 two widely used tools were found to leave data from the original image behind in edited files: Android’s image export (CVE-2023-21036, a failure to truncate images) and the Windows Snipping Tool (CVE-2023-28303). Both were patched, but the lesson holds: export a new image rather than overwriting the original, and share the export.

Where the image is processed matters

Many online editors upload your screenshot to their servers before you redact anything, so the unredacted original has already left your device before you redact anything. A tool that works locally avoids that step entirely.

A checklist before you share

1. Look at the whole frame, not just the part you meant to show: corners, tabs, notifications, the menu bar.
2. Crop out anything you don’t need. What isn’t in the image can’t leak.
3. For secrets (API keys, passwords, tokens), crop them out or cover them with a solid bar, and rotate the key if it was ever on a shared screen.
4. For names, emails and customer rows you need to keep in frame, use coarse pixelation baked into the image, never an overlay.
5. Export a fresh image instead of sharing the edited original file.
6. Open the exported file and check it once more, zoomed in, before you post it.

How to do it in Popshot

1. Open the editor and drop in, paste or pick your screenshot. Nothing is uploaded.
2. Use Crop to cut away everything you don’t need.
3. Use Blur to cover what has to stay in frame. For secrets, pick Solid: an opaque black bar that holds none of the original pixels. For names or avatars, pick Pixelate or Blur; both are computed from the original pixels in blocks of at least 24×24, and Blur holds no more of the original than Pixelate does.
4. Add a background, frame or arrows if you like, then export. The file is made fresh in your browser, so it contains only what you see.

Blur, Solid bars included, and Crop are free, with no signup. Free exports carry a small “popshot.app” watermark; Pro removes it.