How to Redact a Screenshot Before You Share It

You cropped out the account number and scribbled over the name. The screenshot looks safe to send. Whether it actually is comes down to two things most people never check.

The short version: cover the sensitive area with a solid, fully opaque box — not a blur, not a translucent marker — then save a flattened copy and reopen that copy to confirm the cover is still there and nothing peeks out at the edges. Treat your phone's crop-and-markup tool as a convenience, not a guarantee.

Redactions on screenshots fail in two ways, and both are invisible in the finished picture. The first is the method: a blur or a highlighter-style marker only obscures the pixels instead of destroying them. The second is the file: some editors save your edit without fully rewriting the image, so the original data lingers inside it. Each has leaked information that people believed was hidden.

Why a blur or a marker isn't enough

A blur doesn't delete anything — it spreads each pixel into its neighbours in a predictable, mathematical way. Because the operation is reversible in principle, text and faces have been recovered from blurred and lightly pixelated images. The highlighter-style "marker" in many annotation tools has a related problem: it paints translucent ink, so the characters underneath can still be read by lifting the contrast. We go deeper on this in how to redact an image the right way; for a screenshot, the safe choice is a solid, 100%-opaque fill. Nothing survives under a filled black rectangle.

The part you can't see: your editor might keep the original

Even a solid black box can fail if the editor doesn't rewrite the whole file. In 2023, researchers Simon Aarons and David Buchanan disclosed a flaw nicknamed aCropalypse in Google's Pixel "Markup" screenshot editor (CVE-2023-21036). When you cropped or redacted a screenshot, the tool wrote the smaller edited image into the same file without truncating it — so the tail of the original image stayed behind and could be partially reconstructed. The same class of bug was then found in the Windows Snipping Tool and Snip & Sketch (CVE-2023-28303).

The consequence was exactly the one that matters here: a cropped or redacted screenshot could be partially recovered, including the sensitive details — card numbers, licence plates — that people had deliberately covered. Google patched Pixel devices in the March 13, 2023 security update and Microsoft followed shortly after, so current, updated tools are fixed. But the lesson outlives the bug: a redaction is only trustworthy when the exported file is rebuilt from the visible pixels alone, with no leftover original data attached.

What else a screenshot gives away

The field you're thinking about is rarely the only thing in frame. Before sharing, scan the whole image for context you didn't mean to include:

• Window chrome — the browser tab title and the full URL, which can carry account IDs or search terms.
• Notification banners — a message preview that slid in while you were capturing.
• Autocomplete and suggestions — a dropdown exposing other addresses, names or recent searches.
• Account identifiers — your name, email or avatar in a sidebar or header.
• Timestamps — the clock, "last seen" labels, or message times that place you somewhere specific.
• Metadata — a plain screenshot usually has none, but one that was edited or shared from your camera roll can pick up tags. See removing EXIF and GPS metadata from photos.

How to redact a screenshot so it stays redacted

Put the two lessons together — destroy the pixels, and rebuild the file — and the process is quick:

1. Cover it solidly. A filled black box for text, numbers and credentials; heavy pixelation (large blocks) for a face.
2. Export a rebuilt image. Save a flat PNG or JPEG that is re-encoded from the edited picture, rather than an edit written back into the original file.
3. Reopen and verify. Check the exported copy: the box is fully opaque, nothing shows at the cropped edges, and no banner or sidebar slipped in.
4. Strip metadata if needed. If the image came from a photo library or another editor, remove any tags before sharing.

RedactLocal's image redactor is built for exactly this. You drag a box over the sensitive area and it burns solid black (or averaged pixelation) into the pixels, then exports the picture re-encoded from scratch — so there is no original tail left in the file, aCropalypse-style — and it drops the image's EXIF and GPS metadata in the same step. It runs entirely in your browser, so the screenshot is never uploaded; you can turn your Wi-Fi off and it still works. For metadata alone, the metadata remover does the stripping without touching the pixels.

This is the same principle that trips people up with documents: covering something is not the same as removing it. If you work with PDFs too, The Black Box Flaw explains why a black bar over text in a PDF leaves the words fully intact underneath — and what to do instead.