The one-line version
Blur and pixelation are reversible transformations of the original pixels. Only an
opaque fill on a flattened image removes the information — and only if the tool never
wrote an unredacted copy somewhere else.
## Related reading
- [How to redact a screenshot on Windows](/blog/how-to-redact-a-screenshot-on-windows/) — the practical steps in Snipping Tool, Paint and SnapShield.
- [Redacting screenshots for GDPR](/blog/gdpr-screenshot-redaction/) — what regulators expect when a screenshot contains someone else's data.
- [I ran deconvolution on my own redaction output](/blog/gaussian-blur-is-not-redaction/) — the theory above, measured: what actually came back, and what did not.
- [How to redact a PDF so the text is actually gone](/blog/how-to-redact-a-pdf/) — the same mistake in documents, where the hidden text copies straight out.
- [Removing an object from a screenshot is not redacting it](/blog/remove-object-from-screenshot/)
## Selective redaction: hide the sensitive parts, keep the screenshot readable
Source: https://nexoradia.com/blog/smart-blur-selective-redaction/
Summary: Blanket-blurring a screenshot makes it useless as documentation. How targeted detection finds only the sensitive regions — and where it still needs a human.
Published: 2026-08-14
There is a tension in every screenshot you have to share. Redact too little and you leak
something. Redact too much and you have shipped a picture of black rectangles that proves
nothing and helps nobody.
Support tickets are where this bites hardest. The agent needs to see the error, the state
of the form, which tab was open, what the sidebar said. What they do not need is the
customer's name, email, account number and the API key sitting in the address bar. Blur
the whole upper half and the screenshot no longer answers the question it was attached to.
## The two bad equilibria
**Blanket blurring.** Everything above the fold gets smeared. Safe, useless. This is what
people do when they are in a hurry and do not trust themselves to spot every leak, and it
is why so many bug reports are functionally empty.
**Spot redaction by eye.** You cover the four things you noticed. The problem is the fifth
— the notification toast that appeared mid-capture, the autocomplete dropdown still open,
the account email in the corner of the UI you stopped seeing months ago. Human attention
is exactly the wrong tool for exhaustive search over a busy image.
Both failures come from the same place: deciding what to hide is a *detection* problem,
and people are bad at detection over cluttered visual fields.
## What targeted detection does instead
The approach in SnapShield AI's Smart Blur is to find the sensitive regions specifically,
and leave the rest of the image untouched and sharp. Two detectors run:
**Faces**, via an on-device ONNX model. This is the one genuinely machine-learned
component in the tool — a face detector that returns bounding boxes, running locally
against the image with no network call.
**Sensitive data**, via the Windows OCR engine plus structural validation. OCR reads the
text regions; each candidate is then matched against patterns that verify shape rather
than merely looking plausible. Card numbers are checked with the Luhn algorithm. IBANs are
checked with mod-97. National IDs are matched by their actual formats — a US SSN's
`000-00-0000`, a UK NINO — or by a label next to a value, so `Passport No: X1234567` is
caught even though `X1234567` on its own is just a token.
That validation step matters more than the pattern list. An earlier revision of this
detector matched "any 9–12 digit number" as a national ID and flagged order numbers, row
counts and timestamps. A detector that fires constantly gets switched off, and a detector
that is switched off protects nothing.
The current detector covers email addresses, phone numbers, credit cards, IBANs, bank
details, JWTs, API keys — bare, bearer, labelled and vendor-prefixed forms — national IDs,
passwords, usernames, IP addresses, physical addresses and personal names.
Crucially, **generic visible text is deliberately left alone.** The point is not to blur
text; it is to blur the text that identifies someone. The error message stays readable.
## Blur is the wrong verb for the sensitive case
Worth being blunt about this, because it is the thing most likely to hurt you.
Smart Blur applies a heavy Gaussian to the regions it finds, with a feathered edge so the
patch does not look pasted on. That is the right treatment for *softening* a busy
background or a face in a screenshot you are publishing casually.
It is **not** the right treatment when the underlying data must be unrecoverable. A blur
is a convolution with a known kernel, and it has an inverse — the original content can be
approximated back out of the output.
[The mechanics are here](/blog/can-blurred-text-be-recovered/), and they apply to our blur
exactly as much as anyone else's.
When the requirement is removal, use solid redaction, which replaces the pixels rather
than mixing them. In SnapShield AI that is the Redact tool and AI Redact's solid style, and
we hold both to a stricter standard than "looks gone": pixel-level tests fail our build if
a redacted region still correlates with what was underneath it. We shipped 1.6.2 as a
security release precisely because an earlier build failed that bar.
So: **Smart Blur for tidying, solid redaction for protecting.** If you would be unhappy
seeing that region reconstructed, blur is not what you want.
## Detection is a first pass, not a review
No detector finds everything, and the ways it fails are worth knowing before you rely on
it.
- **Faces at an angle, partly occluded, very small, or in poor light** are missed by face
detectors generally. This one is no exception.
- **OCR is the ceiling on data detection.** If the OCR pass cannot read the text — low
contrast, unusual font, heavy compression artefacts, a screenshot of a screenshot — the
pattern matching never sees it. There is nothing to match against.
- **Windows OCR needs a language pack.** If the relevant one is not installed, detection
quietly finds nothing and reports "nothing sensitive found". That reads like the image
is clean when it actually means the detector never ran properly. If you get that result
on an image you know contains an email address, check your Windows language settings
before trusting it.
- **Context is not detected at all.** A licence plate, a name badge, a whiteboard, an
internal hostname in the URL bar, a door number — none of these are faces or pattern
matches. They are yours to catch.
The honest framing is that detection removes the tedium of the obvious cases so your
attention is free for the non-obvious ones. It does not replace looking at the image.
## A workflow that holds up
1. **Run detection first.** Let it mark the faces and the pattern-matched data.
2. **Read the image as a stranger.** Window titles, browser chrome, toasts, sidebars,
counts, reflections, the filename.
3. **Choose the treatment per region.** Solid redaction for anything that must not be
recoverable; blur only where the goal is tidiness.
4. **Export flattened**, to PNG or JPEG.
5. **Verify the export.** Open it in a different program, zoom to 400%, push brightness and
contrast to the extremes. Solid regions stay flat. Anything that ghosts was not removed.
That last step takes fifteen seconds and is the only one that tells you the truth.
## Related reading
- [Can blurred text be recovered?](/blog/can-blurred-text-be-recovered/)
- [How to redact a screenshot on Windows](/blog/how-to-redact-a-screenshot-on-windows/)
- [Redacting screenshots for GDPR](/blog/gdpr-screenshot-redaction/)
- [Screenshots for documentation](/blog/screenshots-for-documentation/)
## How to redact a screenshot on Windows (without leaving the data in the file)
Source: https://nexoradia.com/blog/how-to-redact-a-screenshot-on-windows/
Summary: Step-by-step redaction in Snipping Tool, Paint and SnapShield AI — including the checks that tell you whether the sensitive pixels are actually gone.
Published: 2026-08-13
Windows gives you several ways to cover part of a screenshot. They are not equally safe,
and the differences are not visible in the result. This walks through each one, says
plainly where it fails, and ends with the verification step almost every guide leaves out.
If you only take one thing away: **cover it with a solid opaque shape and export a
flattened image.** Everything below is detail on how to do that in each tool.
## Option 1 — Snipping Tool (built in, Windows 11)
Recent Windows 11 builds added redaction to Snipping Tool, including a Quick Redact that
uses OCR to find email addresses and phone numbers on its own.
1. Take your screenshot (`Win` + `Shift` + `S`) and open it in Snipping Tool.
2. Choose the redaction tool from the toolbar.
3. Either drag over each sensitive region, or use Quick Redact to let it find contact
details automatically.
4. **Save as PNG** with `Ctrl` + `S`. Do not just copy to clipboard and paste into an
email client — some clients keep more than you expect.
**Where it is strong:** it is already installed, it applies a solid block rather than a
blur, and the OCR pass catches things you would have missed.
**Where to be careful:** Quick Redact finds the patterns it knows — emails and phone
numbers. It will not find an API key, a licence plate, a face, an account balance or an
internal hostname. Treat it as a first pass, then go over the image yourself.
## Option 2 — Paint (built in, every Windows)
Crude and completely reliable, which is a reasonable trade.
1. Open the screenshot in Paint.
2. Pick the rectangle shape, set **Fill** to a solid colour, and set the outline to the
same colour.
3. Drag a filled rectangle over each sensitive region.
4. Save as PNG.
There are no layers in Paint. The moment you draw the rectangle, the pixels underneath are
overwritten in the working image, and saving writes exactly what you see. The failure mode
of "the redaction was a separate object" simply cannot happen here.
**Where to be careful:** there is no undo once saved over the original, so work on a copy.
And do not use the airbrush or the blur-ish effects — only a solid filled shape.
## Option 3 — SnapShield AI
This is our tool, so read the following with that in mind. It exists because the two
options above are either pattern-limited or manual.
1. Open or paste the screenshot.
2. For automatic detection, run AI Redact — face detection and sensitive-data detection
run locally and propose regions for you to accept or adjust.
3. For anything it missed, drag the Redact tool over the region.
4. Export to PNG or JPEG.
Two properties we care about, both of which you should demand of any tool:
- **The export destroys the pixels.** Redacted regions are replaced in the exported
image, and we have pixel-level tests that fail our build if a redacted region still
correlates with what was underneath it.
- **Nothing is uploaded.** Detection runs on your machine. There is no server round trip,
which matters because the image you are trying to redact is precisely the image you do
not want to transmit.
There is a free tier with no expiry, so you can check both claims yourself before paying
for anything.
## Option 4 — Things to avoid
**The blur or pixelate tool, in any application.** Both are reversible; the original
characters remain recoverable from the output. This is covered in detail in
[can blurred text be recovered](/blog/can-blurred-text-be-recovered/).
**A black rectangle in PowerPoint, Word or a PDF.** The shape is an object floating above
the content. The text underneath is still selectable and still copies out — see
[how to redact a PDF](/blog/how-to-redact-a-pdf/) for what removes it instead.
**Marking up in a tool and sharing the project file.** `.psd`, `.xcf`, Figma links and
similar keep your redaction as a separate layer over an intact original.
**Highlighter pens and semi-transparent shapes.** Anything below full opacity leaves a
fraction of the original signal, and a levels adjustment amplifies it back into legibility.
## The verification step
Do this once and it becomes a habit. It takes about fifteen seconds.
1. Open the **exported** file — not the editor you made it in — in a different viewer.
2. Zoom to 400% on each redacted region.
3. Raise brightness and contrast to their extremes, and if your viewer has a levels or
curves control, drag the black and white points together.
A correct redaction stays a flat, featureless block through all of that. If shapes,
edges or ghosting appear, the underlying data survived and the file is not safe to send.
For a stricter check on an image you are about to publish widely, open the PNG in an image
editor and inspect the redacted area's histogram. A truly flat fill has a single spike.
Anything with spread means variation, and variation means information.
## Do not forget the parts that are not pixels
A screenshot carries more than the picture:
- **Metadata.** EXIF and PNG text chunks can hold the capture tool, the machine name and
timestamps. Strip metadata before publishing anything sensitive.
- **The filename.** `invoice-acme-corp-45000.png` defeats the redaction inside it.
- **The window chrome.** Titles, tab strips, bookmark bars, notification toasts and the
taskbar routinely leak account names, internal URLs and who else you were talking to.
Crop tightly.
- **Reflections and scale.** Sidebar counts, scrollbar positions and row totals can reveal
the size of a customer list you meant to hide.
- **Auto-saved copies.** If your editor keeps a crash-recovery file or an undo history on
disk, an unredacted version may exist even though your export is clean. Check where your
tool writes those, and clear them.
## A quick decision table
| Situation | Use |
| --- | --- |
| One-off, a couple of regions | Paint — a solid filled rectangle |
| Windows 11, emails and phone numbers | Snipping Tool Quick Redact, then a manual pass |
| Faces, or many screenshots, or regularly | A dedicated tool with local detection |
| Legal, medical, or public disclosure | Redact at the source, then capture |
That last row is the one people skip. When the consequence of a leak is serious, do not
capture the real data and remove it afterwards — put a test account, seeded data, or
edited DOM on the screen first, and screenshot that. There is no recovering pixels that
were never written.
## Related reading
- [Can blurred text be recovered?](/blog/can-blurred-text-be-recovered/) — the maths behind why blur and pixelation fail.
- [Redacting screenshots for GDPR](/blog/gdpr-screenshot-redaction/) — obligations when the data belongs to someone else.
- [Selective redaction](/blog/smart-blur-selective-redaction/) — covering only the sensitive regions, so the screenshot still works as documentation.
- [Scrolling screenshots on Windows](/blog/scrolling-screenshot-windows/) — capturing content taller than the window, and the extra data that comes with it.
## Redacting screenshots for GDPR: what actually has to come out
Source: https://nexoradia.com/blog/gdpr-screenshot-redaction/
Summary: Screenshots in support tickets and documentation are personal data. A practical checklist of what to remove, why reversible blur is a compliance problem, and how to keep a defensible record.
Published: 2026-08-12
A screenshot pasted into a ticket feels like a throwaway artefact. Under GDPR it is a
record containing personal data, stored in a system with a retention policy, discoverable
in an audit, and disclosable in a subject access request.
This is a practical guide, not legal advice — if you are handling a live DSAR or a breach,
talk to your DPO or counsel. What follows is the operational part that engineers and
support teams actually have to get right.
## Why screenshots are the awkward case
Structured data is easy to reason about. You know which column holds an email address, and
you can query it, export it and delete it.
A screenshot is an opaque blob. Nothing in your database knows that the PNG attached to
ticket #4417 contains a customer's full name, home address and the last four of their
card. So it survives every process built around structured data:
- **Retention policies** delete the ticket record and leave the attachment, or delete
neither because nobody classified it.
- **Subject access requests** are answered from the database, and miss the images.
- **Deletion requests** clear the row and leave the screenshot in object storage.
- **Access control** is per-ticket, so anyone in the support tool sees everything in it.
Audits find this reliably, because it accumulates quietly. A published example describes
847 Jira tickets holding unredacted personal data built up over eighteen months, only
discovered during a GDPR audit.
## Reversible redaction is a compliance problem, not just a security one
This is the part specific to redaction technique.
If you blur a customer's address in a screenshot before attaching it to a ticket, you have
not removed the personal data. You have applied a reversible transformation to it. The
data is still in the file, recoverable by anyone who wants it —
[the mechanics are here](/blog/can-blurred-text-be-recovered/).
That distinction matters legally, because "we redacted it" is a claim about what the file
contains. If the original characters can be reconstructed from what you shipped, then:
- The disclosure still contained personal data, and any lawful basis you relied on for
redacted disclosure does not cover it.
- In a DSAR where you redacted third-party data to protect their rights, that protection
did not happen.
- If the file was shared externally, you may be looking at a personal data breach rather
than a near miss.
Anonymisation under GDPR is judged by whether re-identification is reasonably possible,
using means reasonably likely to be used. Running a deconvolution over a blurred region is
well within "reasonably likely". Pixelation is worse — it is a brute-force match against a
small space of candidate strings, and it is exact.
**Use an opaque fill on a flattened image.** It is the only common technique where the
output genuinely does not depend on the input.
## What to remove from a screenshot
Work through this list every time. The obvious items are rarely what gets missed.
**Direct identifiers**
- Names, in content *and* in window titles, tab titles and profile menus
- Email addresses, including the signed-in account in the corner of the UI
- Phone numbers, postal addresses, dates of birth
- Account numbers, customer IDs, national insurance / SSN / national ID numbers
- Photographs of people, including avatars and video-call tiles — and note that
[blurring a face rarely anonymises it](/blog/blur-faces-in-screenshots/)
**Financial and credential data**
- Card numbers, IBANs, sort codes — including partial numbers, which combine with other
sources
- API keys, tokens, session IDs and anything in a URL after `?`
- QR codes and barcodes, which survive being small and are read by machine, not eye
**The quiet ones**
- **Browser chrome.** The URL bar leaks internal hostnames and customer identifiers in
paths. Bookmarks leak org structure. Other tabs leak what else the person was doing.
- **Notification toasts.** A Slack or Teams popup that arrived mid-capture puts a third
party's name and message into your file.
- **Sidebars and counts.** "1,284 customers" tells a competitor your size and tells an
auditor you screenshotted a full customer list.
- **Timestamps and presence.** "Last seen 14:02" is behavioural data about a person.
- **Reflections in the UI.** Recently-viewed lists, autocomplete dropdowns and search
history reveal records the screenshot was not supposed to be about.
- **File metadata.** EXIF and PNG text chunks carry the tool, the machine name and the
time. Strip them.
- **The filename itself.** `dispute-jane-smith-refund.png` undoes the redaction inside it.
## Special care with DSARs
When you disclose records to a data subject, you must give them their data while
protecting the rights of others in the same document. In a screenshot that usually means
redacting a colleague's name from an internal thread, another customer visible in a list,
or a support agent's personal details.
Two rules that save trouble later:
1. **Redact third-party data, not inconvenient data.** Removing something because it is
embarrassing rather than because it identifies someone else is not a lawful redaction,
and it is the thing regulators look for.
2. **Keep a redaction log.** Record what was removed from each file and the reason —
third-party personal data, legal privilege, and so on. If the disclosure is
challenged, the log is the evidence that the redaction was principled rather than
arbitrary.
## Reducing the problem instead of managing it
Redaction is remediation. The cheaper wins are upstream.
**Stop collecting the screenshot.** Much of the time a support agent needs the error
message and the browser version, not a picture of the customer's account page. A form
field beats an attachment.
**Redact at the source.** Reproduce the issue against a test account with seeded data and
screenshot that. Nothing to remove, nothing to leak, nothing to log.
**Redact before it enters the system.** Once the image is in your ticketing tool it is in
backups, search indexes and any integration you have wired up. Removing it later means
removing it from all of those. Redacting on the machine where the screenshot was taken —
before it is ever uploaded — keeps the unredacted version from existing anywhere but that
one disk.
**Set a retention rule that covers attachments,** and confirm it actually deletes the
blob rather than just the row.
**Write it down and train on it.** Most leaks here are not malice, they are an agent in a
hurry who blurred instead of blacking out. A one-page rule — *opaque fill, flatten, check
at 400%* — prevents more incidents than any tool.
## Where a local tool helps
The awkward part of screenshot redaction is that the safest moment to do it is the moment
of capture, on the machine that took it, before the file moves anywhere. That is what
[SnapShield AI](/products/snapshield/) is for: detection and redaction run locally, so an
unredacted copy never has to leave the machine to be processed, and the exported file has
the pixels replaced rather than covered.
It does not make you compliant — no tool does. It removes one specific, common way of
being non-compliant: shipping a file you believed was redacted when it was only blurred.
## Related reading
- [Can blurred text be recovered?](/blog/can-blurred-text-be-recovered/) — why blur and pixelation do not count as removal.
- [How to redact a screenshot on Windows](/blog/how-to-redact-a-screenshot-on-windows/) — the mechanics, tool by tool.
- [Hiding faces in screenshots and photos](/blog/blur-faces-in-screenshots/) — what counts as enough for the photographs in the list above.
- [Redacting a folder of screenshots](/blog/batch-redact-multiple-screenshots/) — when the disclosure is two hundred images rather than one.
## ShareX vs Snagit vs Snipping Tool vs SnapShield AI: an honest redaction comparison
Source: https://nexoradia.com/blog/screenshot-redaction-tools-compared/
Summary: Four Windows tools judged on one question — does the sensitive data actually leave the exported file? Includes where our own tool is the wrong choice.
Published: 2026-08-11
> **Corrected 31 August 2026.** This post originally said Snagit had no automatic
> redaction. Snagit 2025 introduced Smart Redact, which detects addresses, credit cards,
> dates, emails, faces, IP addresses, phone numbers, social security numbers and URLs.
> The table and the Snagit section below are corrected; the correction is left visible
> rather than edited out.
We make one of the tools in this comparison, so treat our verdicts on the others as
informed but interested. What we can do is be specific about criteria, and be honest about
where the free options win — because for a lot of people they do.
The question here is narrow: **when you cover something sensitive and export, is the data
gone from the file?** Capture features, uploaders and workflow automation are covered
briefly, but they are not what this is about.
## The short version
| | Snipping Tool | ShareX | Snagit | SnapShield AI |
| --- | --- | --- | --- | --- |
| Price | Free, built in | Free, open source | Paid, perpetual | Free tier / paid |
| Solid redaction | Yes | Yes | Yes | Yes |
| Automatic detection | Emails, phones (OCR) | No | Smart Redact (2025+): faces + 9 data types | Faces + data patterns incl. API keys |
| Runs entirely locally | Yes | Yes (uploads optional) | Yes | Yes |
| Capture breadth | Good | Excellent | Excellent | Basic |
| Best for | Most people, occasionally | Power users, workflows | Teams making documentation | Redaction-heavy work |
## Snipping Tool — start here
It is already installed, and on Windows 11 it is genuinely capable. Region, window,
full-screen and delayed capture; video; OCR through Text Actions; and a Quick Redact that
finds email addresses and phone numbers on its own and blacks them out.
The redaction applies a solid block, not a blur, and saving produces a flattened PNG. For
the common case — a couple of email addresses in a screenshot going to a colleague — this
is sufficient and free, and we would rather you used it than paid us for something you do
not need.
**Limits.** Quick Redact only knows the patterns it ships with. It will not find API keys,
faces, account balances, internal hostnames, licence plates or names. It is a first pass,
not a review. And there is no batch mode, so twenty screenshots means twenty rounds of
manual work.
**Use it if** you redact occasionally, mostly contact details, one file at a time.
## ShareX — the best free tool, if you will invest in it
ShareX is a remarkable piece of open-source software and the strongest free option on
Windows by a wide margin. Region, window, full-screen, scrolling and GIF capture; an
annotation editor; hotkeys for everything; and a workflow engine where after-capture and
after-upload tasks chain together into genuinely powerful automation.
For redaction it gives you shapes and a highlight tool, and you can draw a filled opaque
rectangle over anything. Applied that way and exported to PNG, the result is sound.
**Limits.** There is no automatic detection of sensitive content — every region is one you
spotted yourself. The interface is dense and configuration-heavy; it rewards investment
and punishes casual use. And its default workflows are built around uploading, so it is
worth going through the destination settings deliberately if the whole point is that
nothing leaves the machine. It will happily do exactly that, but you should confirm it
rather than assume it.
**Use it if** you want maximum capability for zero money and do not mind a steep setup.
## Snagit — for teams producing documentation
Snagit is a mature commercial product aimed at people who make screenshots for a living:
technical writers, trainers, support teams building knowledge bases. Scrolling capture,
step-numbering, templates, a library that keeps a history of everything you have captured,
and a polished editor.
Since Snagit 2025 it also has **Smart Redact**, which detects addresses, credit card
numbers, dates, emails, faces, IP addresses, phone numbers, social security numbers and
URLs on its own, with each type toggleable. That is a real automatic detection feature and
it covers the personally-identifying cases well.
Its blur and "simplify" tools are the ones people reach for to hide sensitive data, and
Smart Redact offers blur as one of its fill styles too. Blur is reversible, so choose the
black bars or pixelation instead — Snagit provides both, they are just not the default
reflex.
**Limits.** It is the most expensive option here. Smart Redact's list is built around
personal data rather than credentials, so API keys, bearer tokens, JWTs and IBANs are not
among the types it looks for. TechSmith does not document applying it across a folder, so
treat it as a per-image feature until you have checked your own version. And the capture
library is a genuine benefit for documentation work and a genuine liability for sensitive
work, because it retains unredacted originals by default.
**Use it if** documentation is your job and the polish and library pay for themselves.
## SnapShield AI — ours
Built for the case where redaction is the main event rather than a step: screenshots that
routinely contain faces, customer data or credentials, in volume.
**What it does that the others do not.** Detection runs locally and proposes regions —
faces via an on-device model, and sensitive data patterns via the Windows OCR engine. You
accept or adjust what it finds. Batch redaction applies to a folder rather than a file at
a time. Exported redactions replace the pixels, and that behaviour is covered by
pixel-level tests that fail our build if a redacted region still correlates with what was
underneath.
We are specific about that last point because we got it wrong. In an earlier build our
solid redaction was drawn at 90% opacity and recoverable with a levels adjustment, and our
blur applied a plain Gaussian that left text legible. Both were fixed in 1.6.2. We would
rather say that plainly than let you find it out.
**Where it is the wrong choice.** Our capture feature set is basic next to ShareX and
Snagit — if you need scrolling capture, GIF recording or an automation pipeline, they beat
us and it is not close. There is no macOS or Linux build. And if your redaction need is
"an email address, twice a month", Snipping Tool already does that and costs nothing.
**Use it if** you redact often, need faces or patterns found for you, or work in batches.
## How to test any of these yourself
Do not take our table on faith. The check takes a minute:
1. Screenshot something with small, high-contrast text — a terminal works well.
2. Redact half of it with the tool's solid fill, and half with its blur or pixelate.
3. Export to PNG and close the editor.
4. Reopen the **exported** file in a different viewer, zoom to 400%, and push brightness
and contrast to the extremes. If your viewer has levels, drag the black and white
points together.
The blurred half will usually give up something. The solid half should stay flat. If a
tool's solid fill does not stay flat, stop using it for anything that matters.
Then check where the tool keeps originals — capture histories, auto-save folders and
crash-recovery files all mean an unredacted copy exists on disk after your export is
clean.
## Choosing
- **Occasional, contact details, already on Windows 11** → Snipping Tool.
- **Free, powerful, willing to configure** → ShareX.
- **Documentation is the job, or you want faces and personal data found for you** → Snagit 2025+.
- **Redaction is the job — faces, patterns, batches** → [SnapShield AI](/products/snapshield/).
Whatever you land on, the technique matters more than the tool: opaque fill, flatten,
verify. A careful person with Paint produces safer files than a careless person with any
of these.
## Related reading
- [Can blurred text be recovered?](/blog/can-blurred-text-be-recovered/)
- [How to redact a screenshot on Windows](/blog/how-to-redact-a-screenshot-on-windows/)
- [Scrolling screenshots on Windows](/blog/scrolling-screenshot-windows/)
- [Watermarking screenshots](/blog/watermark-screenshots/)
## Redact a screenshot without uploading it anywhere
Source: https://nexoradia.com/blog/redact-screenshot-without-uploading/
Summary: Online redaction tools ask you to upload the exact file you are trying to protect. Here is why that is backwards, and how to do the whole job offline on Windows.
Published: 2026-08-10
Search for a way to black out part of a screenshot and most of the first page is web
tools. Drag the file in, drag a box over the sensitive part, download the result.
Look at what that asks you to do. The file contains something you have decided is too
sensitive to share. The first step is to share it — with a third party, over the network,
into infrastructure you cannot inspect.
## What "we delete it after an hour" does and does not cover
Reputable browser tools often say processing happens client-side, in JavaScript, and the
file never leaves your machine. Sometimes that is true. The problem is that you cannot
tell from the outside, and the cost of being wrong is the whole point of the exercise.
Even taking the claim at face value, uploading puts the unredacted file through:
- **Transit and termination.** TLS to a CDN edge that decrypts, inspects and re-encrypts.
- **Logs.** Request logs, error traces and APM tooling that captures payloads on failure.
- **Caches.** Edge caches and object storage with lifecycle rules nobody reviews.
- **Backups.** Which are the reason "deleted after an hour" and "gone" are different.
- **Whatever the operator changes next month**, under a privacy policy that permits it.
None of this requires anyone to be malicious. It is the normal behaviour of normal
infrastructure, and it means the unredacted original now exists in places you cannot
enumerate, let alone delete.
There is also a plainer problem: many of these files are covered by an agreement you have
already signed. Customer data under a DPA, source code under an NDA, patient data under
HIPAA, personal data under GDPR. Uploading it to an unvetted third party is often a breach
of that agreement independent of whether anything bad happens to the file.
## The rule
**The unredacted version should never leave the machine it was created on.**
Redaction is remediation applied to a file that is dangerous until the moment it is
finished. Every hop that file makes before then multiplies the number of places the
sensitive version exists. So the redaction should happen as close to the capture as
possible — ideally on the same machine, in the same minute, before the file is attached
to, uploaded to, or synced with anything.
This also disposes of a common half-measure: redacting a screenshot *after* pasting it
into a ticket, a Slack thread or a shared drive. By then the original is in the platform's
storage, its backups and its search index, and deleting the message rarely removes the
attachment everywhere.
## Doing it offline on Windows
Every option here works with the network cable unplugged.
**Paint.** Rectangle shape, solid fill, same colour outline, drag over the region, save as
PNG. There are no layers, so the pixels are genuinely overwritten. Crude, free, and the
failure modes are easy to reason about.
**Snipping Tool.** On Windows 11 it has a redaction tool and a Quick Redact that finds
email addresses and phone numbers via on-device OCR. Solid blocks, flattened on save.
Good for contact details; it will not find API keys, faces or account numbers.
**ShareX.** Free and open source. Draw a filled opaque rectangle in the editor and save
locally. Its defaults lean towards uploading, so go through the destination settings
deliberately if the point is that nothing leaves the machine.
**SnapShield AI.** Ours. Detection and redaction run on-device — the face model and the
OCR pass both execute locally, so no image is transmitted for processing. Export replaces
the pixels rather than covering them.
Whichever you use, **do not use the blur or pixelate tool.** Both are reversible, and the
original characters can be reconstructed from the output —
[here is why](/blog/can-blurred-text-be-recovered/).
## Verify, then send
1. Open the exported file in a different program from the one that made it.
2. Zoom to 400% on each redacted region.
3. Push brightness and contrast to the extremes; drag levels endpoints together.
Flat and featureless means it held. Any ghosting means the data is still there.
Then check what else is on disk. Auto-save folders, crash-recovery files and capture
histories can all hold an unredacted copy after your export is clean — which reintroduces
exactly the problem you avoided by staying offline.
## The one case for uploading
If the file genuinely contains nothing sensitive — you are blacking out a name for tidiness
rather than for protection — then a web tool is fine and the convenience is real. The
distinction is not the tool, it is whether the file would matter if it leaked.
If the answer is yes, keep it local. It costs you nothing: three of the four options above
are free, and one is already installed.
## Related reading
- [Can blurred text be recovered?](/blog/can-blurred-text-be-recovered/)
- [Redacting screenshots for GDPR](/blog/gdpr-screenshot-redaction/)
- [ShareX vs Snagit vs Snipping Tool vs SnapShield AI](/blog/screenshot-redaction-tools-compared/)
- [Redacting a folder of screenshots](/blog/batch-redact-multiple-screenshots/)
## Hiding faces in screenshots and photos: what counts as enough
Source: https://nexoradia.com/blog/blur-faces-in-screenshots/
Summary: Blurring a face rarely anonymises it. What re-identification actually relies on, why partial covering fails, and how to remove a face so it stays removed.
Published: 2026-08-09
Blurring a face is the single most common redaction on the internet, and one of the least
effective. Not because the blur is weak, but because a face is not the only thing that
identifies a person, and blur is not removal.
## Two separate failures
**The blur is reversible.** A Gaussian blur is a convolution with a known kernel, and it
has an inverse. Given the output and a guess at the radius, deconvolution reconstructs an
approximation of the input. Pixelation is worse: each block is the exact average of the
region under it, which turns recovery into a search over candidate faces rather than an
approximation. Against a constrained set of possible people — a company's staff page, a
class photo, a small town — that search is short. The
[general mechanics are here](/blog/can-blurred-text-be-recovered/).
**Even a perfect removal may not anonymise.** This is the part people underestimate. Face
recognition is one route to identity among many, and the others survive a black box over
the face:
- **Build, posture and gait**, which is why blurring faces in video is weaker still.
- **Hair, tattoos, jewellery, glasses, scars** — often more distinctive than facial
geometry.
- **Clothing**, which places a person at a time and event when cross-referenced with other
photos.
- **Context.** A name badge, a desk, a house number, a car, a reflection in a monitor, a
street sign.
- **Metadata.** GPS coordinates in EXIF identify a home address regardless of what you did
to the pixels.
- **The other people in the frame**, who are identifiable and place the blurred person in
a known group.
- **The surrounding text.** A screenshot of a profile with the photo blacked out but the
bio intact is not anonymous.
So "did I cover the face" is the wrong question. The right one is **"could a motivated
person work out who this is from everything left in the file?"**
## What actually removes a face
**Cover it with a solid, fully opaque shape.** Not blur, not pixelate, not 90% opacity —
that last one leaves a tenth of the original signal, which a levels adjustment brings
straight back. A flat fill is many-to-one: every possible face under it produces the same
output, so there is nothing to invert.
**Cover generously.** Hairline to chin, ear to ear. A box tight to the eyes leaves jaw and
hairline, which are enough for both algorithms and acquaintances.
**Crop instead, when the person is at the edge.** Removing the pixels beats replacing them,
and there is nothing left to argue about.
**Flatten on export.** PNG or JPEG, one layer. If the shape stays an object in a project
file, anyone can move it aside.
**Strip metadata**, especially GPS. Then check the filename.
**Then read the rest of the image as a stranger would.** Badge, screen contents, window
titles, whiteboard, the view out of the window, the other faces. Redact those too or crop
them out.
## When you need the face there but not the identity
Sometimes the picture is about a person being present — a busy office, a conference, a
crowd — and a black rectangle ruins it. Options, roughly in order of safety:
1. **Do not publish that frame.** Pick another shot.
2. **Replace the face entirely** with a flat shape or a synthetic face. Removal, not
obscuring.
3. **Shoot differently.** Back of head, out of focus at capture, or from a distance where
the detail was never recorded. Optical blur at capture time is genuinely destructive in
a way that software blur is not.
4. **Get consent** and skip the problem.
What is not on the list is a heavier blur. A stronger blur is still an invertible
operation; you have changed the parameter, not the category.
## For screenshots specifically
Screenshots have their own version of this. The face is usually a small avatar next to a
name — so the avatar is not what identifies the person, the name is. Blacking out a
profile picture and leaving `@sarah.chen` beside it accomplishes nothing.
Work through the whole surface: display names, handles, email addresses in the account
menu, the signed-in user in the corner, notification toasts from third parties, and the
list of recent contacts in the sidebar. In a video call screenshot, that means every tile,
not just the speaker.
## Doing it at volume
One photo is a manual job. A folder of a hundred support screenshots is not, and this is
where people start cutting corners — which is where leaks come from.
[SnapShield AI](/products/snapshield/) exists for that case. Face detection runs on-device
with an ONNX model, proposes regions, and you accept or adjust them; batch redaction
applies across a folder. Redaction replaces pixels on export, verified by pixel-level
tests in our build.
Two honest caveats. **Detection is a first pass, not a review** — no model finds every
face, particularly at an angle, partly occluded, small, or in poor light, and you are
responsible for the ones it misses. And **detection does not address context**: it finds
faces, not the name badge, the licence plate or the address bar. Those are still yours to
catch.
## The check
Export, then open the exported file in a different program. Zoom to 400% on each covered
region. Push brightness and contrast hard, and pull levels endpoints together. Flat means
it held.
Then do the harder check: hand the file to someone who was not involved and ask them who
they think the person is, and how they worked it out. That test catches the context leaks
a histogram never will.
## Related reading
- [Can blurred text be recovered?](/blog/can-blurred-text-be-recovered/)
- [Redacting screenshots for GDPR](/blog/gdpr-screenshot-redaction/)
- [Redact a screenshot without uploading it anywhere](/blog/redact-screenshot-without-uploading/)
- [Redacting a folder of screenshots](/blog/batch-redact-multiple-screenshots/)
