How to redact a screenshot so it stays redacted
The short answer
Cover the whole sensitive area with a solid, opaque box, then share a newly exported, flattened image — never the original or an editable file. Cropping is not deletion: in 2023 a flaw in Windows Snipping Tool, known as aCropalypse, left cropped-out pixels inside saved files. Researchers have reversed pixelated text, so keep pixelation and blur for faces and long passages, not passwords — and change any key that was ever visible.
Three ways redaction fails
- The hidden part is still in the file. In early 2023 researchers showed that Windows' Snipping Tool, and Google's Markup editor on Pixel phones, could leave the cropped-away part of an image inside a file that was cropped and saved over itself, where it could be recovered. Both were fixed within weeks, but files saved before the fix still carry the leftover data, and the lesson stands: only a freshly exported image is safe to share.
- The cover can be lifted. A black rectangle drawn in PowerPoint, a highlight in a PDF or a layer in an image editor is a separate object. Anyone with the original file can move it.
- Pixelation can be reversed. Research tools such as Depix and Unredacter have reconstructed pixelated text, passwords included, when the font, size and block size are known. Their authors' advice is blunt: for text that matters, use solid boxes, never pixelation or blur.
How to redact properly
- Work on a copy, and capture only what you need to share in the first place.
- Cover the entire value — the whole token, card number or email address, not just part of it — with a margin around it.
- Use a solid, opaque box for text — Paint, for example, draws one with the rectangle shape and a solid fill. Keep pixelation and blur for faces, photos and long passages.
- Export a new image (PNG or JPEG), so the redaction is part of the pixels rather than an object on top.
- Open the exported file and look again before you send it.
Find what you did not notice
The secret that leaks is usually not the one you redacted. It is the API key in the terminal behind the dialog, the customer's email in a browser tab, a session token in a URL, or a name in a notification that appeared as you pressed the key.
ScreenFeel's Find secrets lens draws a box around every finding on the capture itself — keys, tokens, passwords, card and bank numbers, ID numbers, email addresses, phone numbers, addresses and credential-bearing URLs — and says what each one is and how serious it looks. Before any lens runs, ScreenFeel also checks the text it has already read on your PC, with no network call, for key-, token- and card-shaped strings.
Redacting in ScreenFeel's Studio
Studio has a redact tool that pixelates or blurs, and the boxes from Find secrets can be redacted one at a time or all at once. Either way the redaction is flattened into the exported image instead of laid over it, and the export is drawn fresh from the same renderer as the canvas, so nothing of the original pixels survives in the file. Its pixel blocks are coarse — larger than those reversed in published research — but they are still pixelation, so for a short password or key, change the credential as well.
When a secret was already shared
Redaction protects the next share, not the last one. If an image with a working password, API key or token has already been sent anywhere — a chat, a ticket, an email — assume it has been seen: revoke or rotate the credential, then redact and share again.
Questions people also ask
Is blurring enough to hide a password in a screenshot?
Not reliably. Blurred and pixelated text has been reconstructed in research when the font and size are known. Cover the whole value with a solid, opaque box, export a new image, and change the password if it was ever shared unredacted.
Can a cropped screenshot be uncropped?
Normally no, but it has happened. In 2023 the aCropalypse flaw meant some tools, including Windows Snipping Tool, kept the cropped-out data inside the file. Those tools have been fixed, but files saved with the old versions still carry the data; exporting a fresh image is still the safest habit.
Does Windows have a built-in way to redact a screenshot?
On Windows 11, Snipping Tool's Text actions include Quick redact, which hides email addresses and phone numbers it recognises. For anything else — keys, names, faces, numbers — draw over it with an opaque shape and save a new copy.