Private Redaction

Guide · 5 min read

How to black out text on a screenshot (so it can't be recovered)

Screenshots are the most-shared and least-carefully-redacted files there are. Here's how to actually black out the sensitive bits, on a laptop or a phone, so they can't be brought back.

You screenshot a bank balance, an order confirmation, a chat, a boarding pass, and you want to share it with one number or name covered up. It feels like a two-second job. It is, if you do it right. But two of the most common ways of doing it leave the "hidden" information fully recoverable, and you won't be able to tell by looking.

Blurring is not redaction

Blur and pixelate (mosaic) feel like they destroy information. They don't; they scramble it in a predictable, reversible way. Text is especially easy to bring back: it uses a small set of shapes in a known font, so software can work backwards from a blurred or pixelated region and reconstruct what it said. Researchers have demonstrated this repeatedly against real redactions.

The rule is simple: for anything that actually matters, never blur or pixelate. Cover it with solid, fully opaque black, and make sure the covering is baked into the pixels (more on that next).

A black box isn't safe until it's flattened

Drawing a black rectangle over text is only half the job. In many editors the box is a separate layer or annotation that sits on top of the image; the original pixels are still in the file underneath. If you save in a format that keeps layers, or the recipient opens it in the right tool, the box lifts off.

Worse, some built-in screenshot editors have shipped bugs that leave the original image data inside the file even after you crop or draw over it. The best known is "aCropalypse" (CVE-2023-21036), where Google Pixel's Markup tool and the Windows 11 Snipping Tool saved edited PNGs that still contained the un-edited image, recoverable by anyone. The lesson isn't "those tools are bad", it's that trusting an editor to quietly do the right thing is a gamble.

Safe black-out means the result is a flattened image: one layer, where the black pixels have replaced the sensitive pixels and there is nothing underneath. Test it by re-opening the exported file and trying to move or delete the black box. If you can, it wasn't flattened.

Doing it on a laptop

Doing it on a phone

The reliable way: a tool that removes the pixels

The safest option is a tool whose whole job is to output a flattened image with the covered content genuinely gone, and that does it on your device so the screenshot is never uploaded. That's exactly what the Private Redaction browser extension does:

If what you're redacting is a document rather than a screen grab, the web app does the same for PDFs, Word files and images.

One thing screenshots get right, and one to watch

Screenshots usually strip the location and camera metadata that a real photo carries, so you rarely leak EXIF data from a screen grab. But if you're sharing an original photo of a document rather than a screenshot of it, that photo can carry GPS coordinates and a timestamp. Re-saving it as a fresh, flattened image (which any proper redaction step does) drops that too. And check the filename: "statement_acct_8842.png" gives the game away before anyone opens it.

The Private Redaction extension blacks out anything in an image or screenshot, right in your browser, and exports a flat image with the covered content gone for good. Free, and nothing is uploaded. Add it to Chrome, or use the web app.

Takeaways

Related: how to redact a bank statement · how to redact a PDF properly