Redact a screenshot SCREENSHIELD

Black box or pixelate, and why it is not a style choice

Use the black box for anything that is text. Pixelation of characters in a known font is reversible: an attacker renders every candidate string in the same font at the same size, pixelates each one with the same block size, and compares. The space of possible account numbers, reference codes, names and email addresses is small enough for that to finish quickly, and it has been demonstrated end to end against both documents and screenshots.

Pixelation is reasonable for making a face less recognisable at a glance. It is not a redaction, and a blur is worse: a blur is a reversible transform, and the case that made this famous ended in a conviction after the swirl applied to a face was unwound.

The box here is painted into the pixels and the image is exported fresh, so what you download has no layer to peel back and no original underneath it.

The part people miss, which is not the part they redact

Almost every real incident with a screenshot is about something that was on screen and went unnoticed, because the person was looking at the one thing they meant to share. Before you draw a single box, read the four edges: the other browser tabs, a notification that arrived mid-capture, your email address in the profile corner, the Wi-Fi name in the menu bar, the username in a window title, the taskbar.

The address bar deserves its own look. Password reset links, magic sign-in links, pre-signed file URLs and session tokens all live there, and every one of them is a credential: anybody with the string is signed in as you. A screenshot showing one is not a privacy lapse, it is a handover.

Capturing the region rather than the whole screen removes most of that list before you start, and is the single most useful habit here. What a screenshot gives away goes through the rest.

The metadata, which is the small risk

A screenshot is generated rather than photographed, so it carries no GPS and no camera data; those live in EXIF written by a lens. What it does carry is a timestamp, the pixel dimensions, and often the tool that made it. The export here is a new PNG built from the pixels, so none of it travels with the copy you share. The timestamp is the one worth thinking about: a screenshot said to be from Tuesday that carries Thursday's date is a checkable fact, which cuts both ways depending on whose screenshot it is.