What a screenshot gives away
There is no GPS in a screenshot and no camera data, because no camera was involved — the metadata question, which is what most articles answer, has a short and reassuring answer. The risk is the part you can see and did not look at: the other tabs, the notification that arrived, the email address in the corner, the Wi-Fi name, and the session token sitting in the URL bar.
The metadata in a screenshot is mild — a timestamp, the pixel dimensions, sometimes the operating system and the app that took it. There is no GPS in one and no camera data, because no camera was involved. The risk is the part you can see and did not look at: the other browser tabs, the notification that arrived, your email address in a toolbar, the Wi-Fi name in the menu bar, the file path, the account photo, the order number. SCREENSHIELD blacks those out in your browser, and X-RAY shows the metadata that is actually in the file. Neither uploads it.
What is in the file
A screenshot is generated by your computer rather than captured by a lens, so most of what makes a photograph revealing is simply absent. What remains is usually:
- When it was taken. A creation timestamp, and on some platforms a modification one as well. This is the item most worth knowing about, because it can contradict a story: a screenshot said to be from Tuesday that carries Thursday's timestamp is a fact somebody can check.
- The dimensions, which give away the display it came from. A 2556×1179 PNG is an iPhone 15; 3024×1964 is a 14-inch MacBook Pro. It identifies a class of device, not a device.
- The software. Often the operating system's screenshot service or the tool used, written into the PNG's metadata.
- Sometimes a colour profile naming the display model.
What is not there: GPS coordinates, camera make and model, lens, exposure, serial number. Those live in EXIF written by a camera, and a screenshot has none.
One real exception: a screenshot of a photograph does not carry the photo's EXIF — which is why screenshotting an image is a crude but genuine way to strip its location — but a photo you take of a screen with your phone is a photograph and carries everything a photograph carries, including where you were standing.
The part that actually catches people
Nearly every real incident involving a screenshot is about what was visible on screen and went unnoticed because the person was looking at the one thing they meant to share. In rough order of how often it happens:
| Where | What it gives away |
|---|---|
| Other browser tabs | What else you were doing, internal tool names, a client's name in a title |
| A notification banner | A message from somebody, and who they are, in full |
| The toolbar or profile corner | Your email address, your real name, the organisation |
| The menu bar or system tray | The Wi-Fi network name, the VPN, the battery, the clock in your timezone |
| The URL bar | A session token, an internal hostname, a document ID, a query you had typed |
| The window title or file path | Your username, the folder structure, a client or matter name |
| The taskbar or dock | Which applications you run, which says a lot about the organisation |
| The scrollbar | How much more there is, which is sometimes the point being hidden |
The URL bar deserves its own line. Password reset links, magic sign-in links, pre-signed file URLs and session tokens all live in the address bar, and all of them are credentials in the plainest sense: anybody with the string is signed in as you. A screenshot showing one is not a privacy lapse, it is a handover.
Blurring and pixelation do not always work
Two ways they fail, and both have produced real recoveries.
- Pixelation of a known alphabet is reversible. If the hidden thing is text in a familiar font, an attacker can render every candidate string, pixelate each one the same way, and compare. This has been demonstrated end to end against redacted documents and against pixelated text in screenshots. It works because pixelation is a deterministic function, not a one-way one, and the space of possible account numbers or names is small.
- A swirl or a blur can be undone. A reversible transform is reversible; the case that made this famous ended in a conviction after the swirl applied to a face was unwound.
The safe operation is a solid opaque block, painted into the pixels and exported as a new image. SCREENSHIELD offers both and the black box is the one to use when the content matters; pixelation is fine for making a face less recognisable at a glance and is not a redaction.
Cropping is not removing, on some platforms
Worth checking on whatever you use. There have been repeated cases where an operating system's crop was stored as an instruction rather than applied to the file, so the original full image remained inside and could be recovered by anything that ignored the crop — the best-known being the "aCropalypse" bug in Android's Markup and in Windows Snipping Tool in 2023, where cropping a screenshot left the discarded pixels in the saved PNG.
Both were patched, but the lesson generalises: a crop or an annotation applied by an editor is not guaranteed to have removed anything. Exporting a fresh image built from the pixels you want to keep is guaranteed, and it is what a redaction tool should do.
A short routine before you send one
- Capture the region, not the screen. Most of the list above is eliminated by selecting just the window or area you mean. This is the single highest-value habit here.
- Look at the four edges before anything else. Menu bar, taskbar, tab strip, the profile corner.
- Read the URL bar as a stranger would.
- Black out, do not blur, anything that is text and matters.
- Export a new file rather than saving over, so a crop is genuinely a crop.
- Strip the metadata if the timestamp is sensitive — SCRUB or CLEANROOM.
All of it in the tab you have open: a screenshot is usually a picture of something you were not meant to be circulating, and uploading it to a redaction site to make it safe is the wrong order of operations.
Questions people ask about what a screenshot gives away