Guide · 2 min read
How to redact a screenshot safely, so it cannot be undone
Blurring an account number does not hide it, and some editors keep the original image. What goes wrong when redacting screenshots and how to do it properly.
Last updated:
Before sending a screenshot with an account number, an address or a private conversation, almost everyone covers something. The trouble is that many ways of covering things hide nothing at all, or only appear to.
Three ways redaction fails
Blurring. Blur is a well-understood mathematical operation that can be partly reversed. With text, especially numbers, there are few possible combinations, and data has been recovered from blurred screenshots by comparing them against text rendered in the same font.
Pixelating with small blocks. In 2020 a tool called Depix was published that could reconstruct pixelated passwords in screenshots when the blocks were small and the background plain. Pixelation is only safe with large blocks, bigger than the letters themselves.
Trusting the editor. In 2023 it emerged that the screenshot editor on Google’s Pixel phones saved a cropped image over the original without discarding the rest of the file, so part of the full screenshot could be recovered (it became known as “aCropalypse”). Windows’ Snipping Tool had a similar flaw. Both were fixed, but they show that what you see on screen is not always everything in the file.
What does work
- Opaque black boxes that cover the whole detail, with a margin.
- A freshly generated image made from the already-redacted pixels, with no layers, no history and nothing left over from the original file.
- No metadata, because some cameras store a thumbnail of the original photo inside the file itself.
That is exactly what Redact image does: you drag over what you want covered, a black box is painted (or pixelation with blocks of at least 16 pixels, meant for faces) and, when you download, the image is drawn again from scratch. The covered pixels no longer exist in the file. And the image is never uploaded to a server at any point.
What is worth covering in a screenshot
- Account, card and ID document numbers.
- Addresses, email addresses and phone numbers, including other people’s.
- Names and profile photos in screenshots of conversations.
- QR codes and barcodes: the barcode on a ticket or boarding pass can contain your name and booking reference.
- The phone’s status bar, if it shows notifications with private content.
Check before you send
Look at the downloaded image, not the editor’s preview. Check the edges, reflections in glasses or screens, and whether the detail appears again elsewhere in the screenshot: it is common to cover an account number in one place and forget it in another.