Before you post that screenshot: keys, tokens, and tabs

What actually leaks in screenshots

Screenshots are dense with secrets because they capture everything on screen, not just the thing you meant to show. The recurring offenders:

• API keys and tokens in terminals, .env files, and dashboard settings pages
• JWTs and session cookies in DevTools network panels — a pasted 'here's my bug' screenshot can be a working login
• Email addresses, usernames, and internal URLs in browser chrome and address bars
• 2FA codes and one-time links in notification popups that slid in mid-screenshot
• Other browser tabs: titles alone can reveal clients, deals, medical situations, or job searches
• Chat sidebars and taskbar icons showing who you talk to and what's running
• Reflections and background content in photos of screens

Why quick fixes fail

Cropping in some tools is non-destructive — the 'removed' area still exists in the file. Blurring and pixelating text can be reversed for exactly the content screenshots contain: short, structured strings in known fonts (see our guide on blur versus redaction). And a screenshot saved to disk may carry metadata of its own, which travels when the file does.

There's also the revocation rule: if a live credential appeared in an image that left your machine — even briefly, even in a 'deleted' post — revoke and rotate it. Treat the screenshot as a disclosure event; cleanup tools are for everything that isn't a live secret.

A checklist that takes ninety seconds

Before an image of your screen goes anywhere public:

• Look at the whole image, not just your subject: browser tabs, bookmarks bar, address bar, taskbar, notification area
• Search the text in the image for @, http, key, token, Bearer, and anything that looks base64-ish
• Redact with solid rectangles, never blur, for anything confidential
• Check edges and corners — partial lines of a previous window count
• Strip the file's metadata before posting
• If a live secret was visible: revoke it now, then clean the image

How to do this locally

Cleaning a screenshot that contains credentials by uploading it to a random 'free image editor' defeats the purpose. Our Redact Image tool runs in your browser: draw solid-mode rectangles over the sensitive regions, and the export rasterizes a fresh image and verifies — pixel by pixel — that every secure region contains only the replacement color. Blur and pixelate exist but carry a persistent warning for exactly the reasons above. Finish with the Image Metadata tool if the file came from a phone or was edited by apps that write metadata; it reparses its own output to confirm zero fields remain.