Redact a screenshot without uploading it anywhere

Search for a way to black out part of a screenshot and most of the first page is web tools. Drag the file in, drag a box over the sensitive part, download the result.

Look at what that asks you to do. The file contains something you have decided is too sensitive to share. The first step is to share it — with a third party, over the network, into infrastructure you cannot inspect.

What “we delete it after an hour” does and does not cover

Reputable browser tools often say processing happens client-side, in JavaScript, and the file never leaves your machine. Sometimes that is true. The problem is that you cannot tell from the outside, and the cost of being wrong is the whole point of the exercise.

Even taking the claim at face value, uploading puts the unredacted file through:

• Transit and termination. TLS to a CDN edge that decrypts, inspects and re-encrypts.
• Logs. Request logs, error traces and APM tooling that captures payloads on failure.
• Caches. Edge caches and object storage with lifecycle rules nobody reviews.
• Backups. Which are the reason “deleted after an hour” and “gone” are different.
• Whatever the operator changes next month, under a privacy policy that permits it.

None of this requires anyone to be malicious. It is the normal behaviour of normal infrastructure, and it means the unredacted original now exists in places you cannot enumerate, let alone delete.

There is also a plainer problem: many of these files are covered by an agreement you have already signed. Customer data under a DPA, source code under an NDA, patient data under HIPAA, personal data under GDPR. Uploading it to an unvetted third party is often a breach of that agreement independent of whether anything bad happens to the file.

The rule

The unredacted version should never leave the machine it was created on.

Redaction is remediation applied to a file that is dangerous until the moment it is finished. Every hop that file makes before then multiplies the number of places the sensitive version exists. So the redaction should happen as close to the capture as possible — ideally on the same machine, in the same minute, before the file is attached to, uploaded to, or synced with anything.

This also disposes of a common half-measure: redacting a screenshot after pasting it into a ticket, a Slack thread or a shared drive. By then the original is in the platform’s storage, its backups and its search index, and deleting the message rarely removes the attachment everywhere.

Doing it offline on Windows

Every option here works with the network cable unplugged.

Paint. Rectangle shape, solid fill, same colour outline, drag over the region, save as PNG. There are no layers, so the pixels are genuinely overwritten. Crude, free, and the failure modes are easy to reason about.

Snipping Tool. On Windows 11 it has a redaction tool and a Quick Redact that finds email addresses and phone numbers via on-device OCR. Solid blocks, flattened on save. Good for contact details; it will not find API keys, faces or account numbers.

ShareX. Free and open source. Draw a filled opaque rectangle in the editor and save locally. Its defaults lean towards uploading, so go through the destination settings deliberately if the point is that nothing leaves the machine.

SnapShield AI. Ours. Detection and redaction run on-device — the face model and the OCR pass both execute locally, so no image is transmitted for processing. Export replaces the pixels rather than covering them.

Whichever you use, do not use the blur or pixelate tool. Both are reversible, and the original characters can be reconstructed from the output — here is why.

Verify, then send

1. Open the exported file in a different program from the one that made it.
2. Zoom to 400% on each redacted region.
3. Push brightness and contrast to the extremes; drag levels endpoints together.

Flat and featureless means it held. Any ghosting means the data is still there.

Then check what else is on disk. Auto-save folders, crash-recovery files and capture histories can all hold an unredacted copy after your export is clean — which reintroduces exactly the problem you avoided by staying offline.

The one case for uploading

If the file genuinely contains nothing sensitive — you are blacking out a name for tidiness rather than for protection — then a web tool is fine and the convenience is real. The distinction is not the tool, it is whether the file would matter if it leaked.

If the answer is yes, keep it local. It costs you nothing: three of the four options above are free, and one is already installed.

Related reading

• Can blurred text be recovered?
• Redacting screenshots for GDPR
• ShareX vs Snagit vs Snipping Tool vs SnapShield AI