What to redact before you post a screenshot

A screenshot captures everything on screen, not just the part you meant to share. People crop to the useful bit and miss the notification banner above it and the order number under it. Here is the checklist to run before you post one, and why a black box is safer than blur.

The checklist: what leaks from a screenshot

Go through it top to bottom. Most leaks sit at the edges of the frame, not in the middle.

Names and handles. The contact name at the top of a chat. The @handle beside a reply. First names feel harmless until they sit next to a company name and a city.

Faces and avatars. Profile pictures in a group chat, a face on a video call tile, a reflection in a photo of a screen. Small avatars count too. A 30-pixel profile picture is still someone.

Email addresses and phone numbers. Signatures, "reply to" lines, contact cards, the sender line in a mail client.

Order, tracking and account numbers. Receipts, delivery updates and support tickets. An order number plus your name is often enough for a support desk to talk to someone about "your" order.

Addresses and postcodes. Delivery screens, invoices, map pins, ride-share receipts.

Payment details. Card numbers, IBANs, the last four digits next to a full name and billing address.

Dates of birth and ID numbers. Booking forms, insurance screens, anything that says "DOB".

Notification previews. The banner that slid in while you pressed the buttons. It shows who messaged you and the first line of what they said.

Links with tokens. Password reset links, magic sign-in links, "anyone with the link" share URLs, and addresses with ?token=, session= or a long random string. The URL is the key. Posting it hands the door over.

Codes that carry data. QR codes, and the barcode on a boarding pass or ticket, can encode a booking reference or a name. Box them.

The rest of the screen. Other browser tabs, the bookmarks bar, file names on the desktop, the time and date if they place you somewhere, and the second monitor you forgot was in the capture.

Metadata, when it is a photo. A phone photo of a document, rather than a screenshot, can carry EXIF data: the camera model, the time and, if location was on, GPS coordinates. That data travels in the file, not in the pixels you can see.

Why blur and pixelate can be reversed

Blur and pixelation do not delete text. They average it. Each block of a pixelated word is a mix of the letters that were under it, and that mix is predictable when you know the font and the size.

Bishop Fox showed this in February 2022 with Unredacter, an open-source tool that recovered pixelated text. It works by guessing: it renders candidate letters in the same font, pixelates them the same way, and keeps the guess whose blocks match the redacted image. Their advice from that post is blunt: use black bars covering the whole text, and never pixelation or blurring.

Screenshots make this attack easier, not harder. Interface text uses a known system font at a known size on a plain background. That is exactly the setup a guessing attack wants.

A solid box is different. The pixels under it are replaced with one flat colour. There is nothing left to compare a guess against. The only thing a box still reveals is its size, so a box around a short name shows that the name is short. Draw boxes a little wider than the text when length matters.

One more trap: cropping inside an editor is not always deletion either. The 2023 aCropalypse bug in Google Pixel's Markup tool, and a matching flaw in the Windows Snipping Tool and Snip & Sketch that Microsoft patched in March 2023, left cropped-out pixels at the end of the saved file. Both are patched now. The lesson still holds: export a fresh file rather than saving over the original.

A redaction pass that holds up

Run this in order.

Crop first, for relevance. Less on screen means less to check.
Let a finder make a first pass. Pattern matching catches the boring, high-risk strings you skim past: emails, card numbers, links.
Box what the finder cannot know about. Notification banners, QR codes, avatars that are too small to detect, and anything that is sensitive only in context.
Use solid black for anything that must stay secret. Card numbers, passwords, ID numbers, tokens.
Export a new file and look at the export. Not the editor view. The file you are about to post, zoomed to 100 percent.

Doing it with the free image redactor

Versely's screenshot and image redactor follows that pass, in your browser. You can drop, paste or pick up to 10 images at 40 MB each. Nothing is uploaded; the only downloads are the models, once.

Here is what it actually checks, so you know where your own eyes still matter.

Text is read on your device by Florence-2, Microsoft's vision model. Tall screenshots are read in overlapping parts. The first scan downloads the model once, about 230 to 360 MB depending on whether your browser has WebGPU.
Pattern checks then flag emails, phone numbers, payment card numbers, IBANs, US Social Security numbers, dates of birth, links, IP addresses and street addresses or postcodes. Card numbers must pass the Luhn check and IBANs their checksum, so random digit strings are not flagged as cards.
Faces are found with YuNet, a small face detector. It is on by default.
Names are optional. "Find names too" adds an English-trained name model, about 110 MB more. Other languages and all-caps text are weaker. There is also an "Also organisations and places" option once names are on.
Order and account numbers are behind an "Any number with 8+ digits" switch, off by default because totals and reference numbers trip it. Turn it on for receipts and support tickets.

Know the gaps. A date is only flagged as a birth date when a label like "DOB", "date of birth" or "born" sits in front of it. Links are only flagged when they start with http or www, so a bare docs.example.com/… needs a box by hand. Addresses need a house number and a street word, or a UK, US, Indian or German postcode shape. A misread digit makes a card number fail its checksum, and then it is not flagged. Notification banners and QR codes are not detected as such at all.

Every find becomes a coloured box by category. You can switch off single finds or whole categories and drag your own boxes. The findings list shows each match partly masked, so the list itself is safe to screen-share.

Solid black is the default style. Heavy blur and pixelate are offered, and both are coarse on purpose: text boxes keep only one or two blocks per line. The tool itself says to use solid black for card numbers, passwords and IDs, and so do we.

On export, the boxes are painted into the pixels and the image is encoded again as a new PNG. The original pixels under a box are not in the download, and EXIF and location data from the original file are not copied. "Check the result" shows the exported pixels before you save. Batches download as a ZIP.

Documents and photos need different tools

PDFs. Drawing a black rectangle on a PDF usually leaves the text underneath, selectable and copyable. PDF redaction runs the same detectors on the text layer, or on scanned pages through the same vision model. Then it rebuilds every page as a PNG image, so covered text is gone rather than hidden. The trade-off is that nothing in the output is selectable or searchable afterwards. If you only want to know what is in a PDF before deciding, the PDF privacy scanner finds it without changing the file.

Photos where the pixels are fine. If the only issue is location data in a photo, the image metadata stripper removes EXIF and GPS without touching the picture.

Faces and number plates in real-world photos or video. Privacy blur is built for that job. Blurring a face in a crowd is a different risk from blurring a card number. For text, stick with solid boxes.

Windows users also have a built-in option: once you capture a snip, the Snipping Tool's Text actions button can quick redact email addresses and phone numbers. It covers those two categories, so the rest of the checklist still applies.

When you are sharing screens for content

Creators screenshot constantly: a comment for a reply video, a dashboard for a results post, a DM for a story. Viewers pause and zoom. Assume every frame will be read at full size.

If the screenshots are going into a video, that part is where Versely fits: AI video and image generation on the web and in the mobile app. The redaction stays a free job in the browser. For what happens to files once they reach an AI tool, see data privacy for creators using AI.

The short version

Check the edges: banners, tabs, address bar, second monitor.
Use solid black. Blur and pixelation are averages, and averages can be guessed.
Export a new file and inspect it at 100 percent. Automatic finders are a first pass. The last pass is you.

Browse the rest of the on-device utilities in free tools.