The Screenshot Privacy Checklist Before You Post a Dashboard or Terminal

Emails are the most common accidental leak because they show up everywhere: user tables, support tickets, billing pages, error logs. A single customer email in a screenshot is a minor but real privacy problem, and a table full of them is worse.

API keys are the higher stakes version of the same mistake. Live keys have recognizable prefixes, which is actually good news because it means you can catch them by pattern before you post. Stripe live secret keys start with sk_live_, GitHub personal access tokens start with ghp_, AWS access keys start with AKIA, and JWTs start with eyJ (the base64 encoding of the JSON header). If any of these are visible anywhere in your frame, including in a background browser tab or a terminal history above your main content, stop before posting.

Revenue dashboards are a favorite thing to screenshot for build-in-public posts, and also the easiest place to leak more than you intended. A screenshot cropped to show 'this month' revenue can also carry the sidebar showing lifetime revenue, or a churn number, or a customer count you weren't ready to share publicly. Look past the number you're posting for, and check every other number in the frame.

Card numbers show up more often than people expect, usually in a payments admin panel, a refund screen, or a support ticket screenshot. Even a partially masked card number combined with a name and an amount can be enough to cause a real problem for a customer. Phone numbers hide in similar places: contact forms, support tickets, and account detail pages.

If your dashboard shows customer @handles, usernames, or real names, treat that the same way you'd treat an email. A support ticket screenshot with a customer's full name and complaint visible is a trust problem even if the complaint itself is harmless, because the customer never agreed to be shown publicly.

This applies to screenshots of DMs, support chats, and reviews too. If you want to share a nice piece of customer feedback, either get explicit permission to share it with their name attached, or redact the name and handle before posting.

The content you meant to screenshot is rarely the only thing in the frame. Browser tabs at the top can reveal other projects, client names, or unreleased work. A bookmarks bar can do the same. These are usually harmless, but they're also usually irrelevant to what you're posting, so cropping them out just makes for a cleaner screenshot too.

URL bars deserve a specific check. Query strings often carry session tokens, API keys passed as parameters, or internal IDs that shouldn't be public. A URL like yourapp.com/dashboard?token=abc123 leaks the token the moment it's visible in a screenshot, even if the rest of the page is completely fine.

These three redaction methods are not interchangeable, and picking the wrong one for the content matters. Blur is fine for larger areas like a face or a background element where you just want to reduce detail, but a light blur on small text can sometimes still be read with enough zoom and sharpening.

Pixelation looks more thorough than blur, but it has a real weakness: on short text at a coarse pixelation level, the block pattern can sometimes be partially reversed, especially if you know the font and can guess the character set (this is a documented weakness with short strings like keys, prices, or codes). It's better than nothing, but it's not the safest choice for something like an API key.

A solid black bar is the safest option because there's nothing left to reconstruct, it fully removes the pixel information rather than smearing it. Use it for anything high stakes: API keys, card numbers, and anything you'd be genuinely upset to see leaked.

A lot of screenshot redaction tools work by having you upload your image to their server, run detection there, and send it back. That means the very screenshot you're worried about leaking an API key gets sent, key and all, to a third party server before you've redacted anything. If the goal is privacy, uploading the unredacted image anywhere defeats the point.

Shotmesh's privacy scan runs local OCR entirely in your browser. It reads the text in your screenshot on your machine, flags emails, API keys (Stripe, GitHub, AWS, JWT patterns), card numbers, amounts, phone numbers, and @handles, and lets you blur, pixelate, or black-bar each group, all without the image ever leaving your device. The unredacted version never touches a server, including ours.