Most screenshot leaks are not dramatic hacks. They are ordinary people sharing an ordinary image that happened to contain something they did not notice: an API key in a terminal, a password pre-filled by the browser, an internal URL, a customer's email, a two-factor code still valid for twenty more seconds. Redaction is the last line of defense between that image and the internet, and most people do it wrong. This guide covers the techniques that actually work, the one that only looks like it works, and the privacy trap hiding inside most “free online redaction” tools.
Step 1 — Audit the frame before you edit anything
Redaction fails when it is reactive. Before you touch a tool, scan the whole image — not just the obvious secret. The spots people miss:
- The browser chrome. The URL bar often carries session tokens, reset codes, and user IDs as query parameters.
- Tabs and window titles. A neighboring tab can reveal your bank, employer, or a private document name.
- Avatars, names, and email addresses in headers, sidebars, and comment threads.
- Notifications that popped in during capture — messages, calendar reminders, password-manager toasts.
- Metadata and reflections. Some export paths keep timestamps and device info; webcam captures can reflect a second monitor.
List every region that must go before you start drawing boxes. Redaction is far easier when you know exactly what you are hunting.
Step 2 — Crop first; the cheapest redaction is not capturing it
The most secure pixel is the one that never existed. If the sensitive data sits near an edge, crop it away entirely rather than covering it — cropping removes information irreversibly, while every other technique merely obscures what is still present. Capture tightly in the first place and you eliminate most redaction work before it starts. When a secret is central to the frame, move to destructive masking.
Step 3 — Blur is not redaction; mosaic is
This is the single most important distinction in the whole workflow. A Gaussian blur looks convincing at a glance, but the underlying pixel data is largely intact. Given enough of the image, sharpening tools — and increasingly, machine-learning upscalers — can recover legible text from a moderate blur. Blur is obfuscation, not destruction.
A true mosaic (pixelation) downsamples a region to a coarse block grid and scales it back up. The original detail is thrown away; each block is a flat average of the pixels it replaced, so there is nothing left to reconstruct. For text secrets — passwords, keys, tokens, account numbers — a solid opaque rectangle or a heavy mosaic is the correct choice. Use a block size large enough that the shapes underneath are unrecognizable; a fine mosaic over a short password can still leak its length and letter shapes.
Blur hides a secret and hopes nobody looks hard enough. Mosaic deletes it and dares anyone to try.
Step 4 — Verify, then export deliberately
Zoom to 100% and re-scan every masked region — confirm the mosaic covers the secret with margin to spare, not just its center. Then flatten and export to PNG or JPG so the redaction is baked into the pixels, not stored as a reversible layer that a downstream tool or a recipient with the source file could lift. Keep the unredacted original off shared drives and out of cloud-synced folders.
The trap: “free online redaction” tools
Search for “redact screenshot online” and you will find dozens of sites offering free in-browser blurring. Read what that actually requires: to redact your image, the site must first receive your unredacted image. You upload the original — secrets fully visible — to a server you do not control, so that it can hand you back a masked copy. The masked copy is safe. The original on their server is the problem: it lands in request logs, temporary storage, backups, and analytics pipelines you will never see and cannot delete. Redaction in the cloud quietly defeats the entire purpose of redaction.
The same logic applies to any tool that “syncs” or “processes in the cloud.” For genuinely sensitive data, local redaction is the only defensible option. It is the same principle we cover in our guide to redacting screenshots without uploading them — capture, destroy pixels, crop, verify, export, entirely on your own device.
Built-in mosaic vs. online blur sites vs. a local extension
| Approach | Destroys pixels? | Original leaves your device? |
|---|---|---|
| Online redaction website | Usually blur only | Yes — uploaded to their server |
| Desktop image editor (GIMP, Photoshop) | Yes — pixelate/fill | No — but multi-step |
| OS screenshot tool (Snipping Tool, macOS) | Blur/marker, weak mosaic | Sometimes cloud-synced |
| SnapLocal (Chrome extension) | True mosaic, free & unlimited | Never — zero host permissions |
A local, browser-native editor gives you a destructive mosaic without the upload
and without the learning curve of a full image editor. SnapLocal applies a real
pixel-destructive mosaic in one click, stores everything in
chrome.storage.local, declares zero host_permissions,
and has no code path that could send your capture anywhere. On a Chromebook the
same workflow applies; see our guide to
annotating screenshots on
ChromeOS without uploading anything.
A five-point pre-send checklist
- Did I capture only what's necessary — can I crop instead of mask?
- Is every secret covered by a destructive mosaic or solid fill, not a light blur?
- Did I check the URL bar, tabs, notifications, and corners?
- Did I flatten/export so the redaction is baked into the pixels?
- Did the original stay on my device — never routed through an online tool?
Verify, don't trust
Redaction quality is testable. Export your masked image, open it at 100%, and try to read what's underneath. If you can make out letter shapes or digits, the mosaic is too fine — increase the block size or use a solid fill. If you used an online site, assume the unredacted original is already on someone else's server and treat the secret as compromised: rotate the key, change the password. For a broader look at which capture tools never upload, see our roundup of the best private screenshot tools for 2026.