Guide
What people forget to hide in screenshots
Most leaks in a screenshot are not the thing you sat down to hide. They are the column on the left, the string in the address bar, and the banner that arrived while you were cropping. Walk the list before you send the file.
Last updated
What should you check in the address bar?
Read the URL as if you had to paste it into a chat. Query strings and fragments hide emails, invite tokens, reset codes, and customer ids. The tab title often repeats a person’s name after you covered the page heading. Cover the sensitive part and leave a path that is safe to share.
Read the URL as if you had to type it into a chat. Query parameters are where emails, invite tokens, password-reset codes, and customer ids hide. A fragment after the hash can do the same. The tab title often repeats the document name or the person’s name even after you covered the page heading. Cover both, or cover the sensitive part and leave a path that is safe to share.
Other tabs in the same window are part of the picture if your screenshot tool captured the tab strip. So are bookmarks with internal hostnames. A single visible hostname can tell a stranger which vendor, hospital, or client you were logged into.
What do chat sidebars leak?
A chat sidebar is a list of names, client channels, and coworkers, even when you only meant to share one message. Crop to the message when you can. Use black boxes when the sidebar is stuck to a layout you still need. The same trap sits on the right of a ticket: phone, company, and owner.
Slack, Teams, Discord, and email all put a list of other conversations next to the one you meant to share. That list is names. Channel names can be client names. Direct messages show coworkers. Unread badges imply who is active. If the point of the screenshot is one message, crop to that message or black out the sidebar. Cropping is better when you can do it without cutting the point. Black boxes are better when the sidebar is glued to a layout you need to show.
The right side of a ticket or a CRM record is the same trap: a customer card, a phone number, a company, an owner. You looked at the left column where the bug is. The right column is what identifies the person.
Which faces and badges get left in the shot?
A video tile, a profile photo, a badge, and a reflection in a monitor are all identifying. Blur or pixelate the whole head, not only the eyes. If a name is printed under the face, black that name out too. Cover a whole license plate or house number, not a slice through the middle.
A video call in the corner, a profile photo, a badge photo on a lanyard, and a face reflected in a monitor are all identifying. Blur or pixelate is usually the right look for a face. Include enough of the head that the person is not still obvious from hair and glasses. If a name is printed under the video tile, that name needs a box too. A blurred face with a sharp name is not anonymized.
License plates, house numbers, and school names in the background of a photo follow the same rule. Cover the whole plate or the whole number, not a stylish slice through the middle. The guide on blur versus black box is the decision for how strong that cover should be.
Which text do people think they already removed?
Emails, phone numbers, and street addresses show up in headers, signatures, and the smallest table row. File paths contain usernames. Long random strings in a log or a config screen are often secrets even when they are not labeled “key.” Notification banners at the edge of the screen arrive at the worst moment.
Emails appear in from-lines, in avatar fallbacks that show initials plus a full address on hover that you accidentally captured, and in the footer of a forwarded message. Phone numbers appear in signatures. Physical addresses appear on invoices and maps. Account numbers appear in the smallest row of a table, which is the row you did not zoom.
File paths leak usernames. A terminal prompt that says jane@laptop, a VS Code title, a download bar, and a “recent files” menu are all names. API keys are not always labeled “key.” They look like long random strings in a .env preview, a CI log, or a mobile config screen. If you would rotate it after posting, black it out before posting.
Notification banners are timed badly on purpose, from the screenshot’s point of view. A message preview with a few words of a private text, a calendar invite titled with a person’s name, or a password-manager popup can land in the shot. Look at the top and bottom edges. Those are where operating systems put banners.
- Emails in headers, chips, and sharing dialogs.
- Phone numbers and street addresses on invoices, maps, and contact cards.
- Tokens and long random strings, even when the label is missing.
- Usernames inside file paths, prompts, and window titles.
- Notification and calendar banners at the edge of the screen.
- Clipboard history or password prompts that overlap the window.
How do you read the export like a stranger?
Open the PNG outside the editor, zoom, and read every remaining sharp string. If you hesitate on a name, an email, or a key, cover it. Attach the redacted file, not the original screenshot with a similar name. Do not paste the secret into the message that explains the redaction.
Open the PNG outside the editor. Zoom. Read every remaining sharp string out loud. If you hesitate, cover it. Check that the filename you are attaching is the redacted one. “Screenshot 2026-09-25” is often the original, and “redacted-image.png” is the export from this site. Attach the second file.
Do not send the original to yourself in email “just in case” and then forward the thread. Do not paste the secret into the message that explains the redaction. If the image is going to a public issue tracker, assume it will be copied. The checklist is the same for a private ticket if the ticket system is something you do not fully control.
This is manual on purpose. The editor does not guess which face or which string matters. You draw the boxes. That is slower than an automatic detector and it is also why a customer screenshot never has to be uploaded to find out. Use black box for the strings on this list that are secrets, and blur or pixelate for faces and plates. Then look once more.
Questions about this
People ask whether a crop is enough, whether a blurred face with a visible name still counts, and whether they should check the exported file or trust the preview. Crop when you can. Cover names even if the face is gone. Open the PNG before you attach it.
Is cropping better than drawing a box?
Crop when the sensitive part is not needed to explain the point. A crop removes the pixels from the frame. A black box is better when the sidebar is glued to a layout you still need to show. Either way, check what remains.
Does a blurred face count if the name is still visible?
No. A name under a video tile, on a badge, or in a caption identifies the person. Cover the name with a black box. Blur or pixelate the face itself, including hair and ears if those would still give them away.
Should I trust the editor preview?
Open the exported PNG outside the editor and read it at a large size. The original screenshot is still on your device, often with a similar name. Attach the redacted PNG, not the first file the share sheet offers.
Where should you go next?
Apply the cover in the same local editor this guide describes. Paste a screenshot on the homepage, or open a related note if the leak is a different kind. These links are the next step. They are not separate tools that upload the file.