How to blur sensitive information in a screenshot (and why most blurs are reversible)

Blurring an API key out of a screenshot feels safe. Often it is not. Here is what actually removes the data, what only appears to, and how to check which one you just did.

The problem with most blur tools

A Gaussian blur does not delete information. It redistributes it. Each output pixel is a weighted average of its neighbours, which means the original values are still present in the image — spread out, but mathematically related to what they were.

For photographs that hardly matters; nobody is recovering a face from a heavy blur. For text it matters a great deal. Text is high-contrast, uses a known alphabet, and sits on a flat background. Those three properties make it unusually easy to attack. Given a blurred crop and the font, an attacker can render every candidate string, blur each one with the same radius, and compare. The match that lines up is the original text.

What actually destroys the data

Three approaches genuinely remove information, in rough order of how much they remove:

1. Draw a solid, opaque box over it. Nothing survives a filled rectangle. This is the safest option and the one to use for credentials.
2. Pixelate at a large block size, then blur the result. Averaging pixels into big blocks discards the detail outright; the blur afterwards removes the block edges, which would otherwise still carry structure.
3. Crop the region out entirely. If the sensitive part is at the edge of the screenshot, cutting it off is both the simplest and the most complete fix.

A light blur alone belongs in none of these categories. If you are hiding something that would actually cost you — a token, a password, a customer name — use a solid box.

The mistake that undoes all of it

Editing tools that keep layers will happily save your redaction as a separate object floating above the original pixels. Anyone who opens that file can move or delete the box and read what is underneath.

• Saving as PSD, XCF, or a Figma or Sketch file keeps the layers.
• Saving as PNG or JPG flattens them into a single image.
• Exporting to PDF may or may not flatten, depending on the tool — several high-profile leaks have come from PDFs where the black bar was a separate object.

Whatever tool you use, export to a flat image format before sharing, then reopen the exported file and check the redaction is still there and still opaque.

Doing it on Windows

1. Press Windows + Shift + S to capture the region you want.
2. Open the capture in Snipping Tool from the notification that appears.
3. Snipping Tool on Windows 11 has a redaction option. If yours does not, use the highlighter at full opacity in black, or paste into Paint and draw a filled rectangle.
4. Save as PNG. Do not save as anything that keeps layers.

Doing it on macOS

1. Press Control + Command + Shift + 4 and drag to capture straight to the clipboard.
2. Paste into Preview, or save the file and open it.
3. Use Tools, then Annotate, then Rectangle. Set the fill to solid black and cover the sensitive area.
4. Flatten it: File, then Export, then choose PNG. Exporting is what removes the annotation layer.

Doing it in the browser with PasteSnip

PasteSnip has a redaction tool built into its editor, and it is deliberately not a CSS filter. It reads the selected region out of the canvas, averages the pixels into large blocks, blurs the result to remove block edges, and writes the changed pixels back into the image before anything is uploaded.

1. Paste your screenshot onto pastesnip.com with Ctrl+V.
2. Click Edit / Annotate on the image page.
3. Pick the Blur tool, or press B, and drag over the sensitive region.
4. For credentials, use the Filled box tool instead — press F — which paints a completely opaque rectangle.
5. Save. The original pixels never leave your browser.

The important detail is the order of operations. The redaction is applied to the pixel buffer in your browser, and only the redacted result is uploaded. The unredacted version is never transmitted and never stored.

How to check your redaction actually worked

Do not trust how it looks at normal size. Two quick checks:

1. Open the exported file and zoom to 400%. If you can make out letter shapes or a consistent stroke pattern, the redaction is too weak.
2. Increase contrast hard — most image viewers have an auto-contrast or levels option. Weak blurs give up their structure immediately under contrast enhancement.

If either check reveals structure, go back and use a solid box.

A short rule of thumb

When the cost of being wrong is a rotated credential and an incident report, the extra two seconds for a solid box is not a difficult trade.