What is in this screenshot?
People paste screenshots into issue threads all day, having stopped seeing their own screen.
A screenshot carries everything that was on screen, including the parts you had stopped noticing. API keys in a terminal, an account number in a banking tab, a customer address in a support tool: these end up in issue threads, blog posts and bug reports every day. This reads the text in the picture, matches it against the shapes of things that should not travel, and covers the ones you pick.
What it looks for
- API keys and tokens: AWS, GitHub, Stripe, Slack, Google, OpenAI.
- JSON web tokens and private key headers.
- Card numbers, checked against Luhn so ordinary digits are not flagged.
- Email addresses, public IP addresses and phone numbers.
Why it runs on your device
- The tool exists to find secrets in your screenshots.
- Doing that as a service means uploading those screenshots to a stranger.
- The text recognition and the matching both run in this tab.
- Nothing is sent anywhere, which is the only way the idea makes sense.
Questions
What counts as a leaked secret in a screenshot?
Anything that authenticates or identifies. API keys and tokens are the serious ones because they can be used immediately; card numbers and bank details follow; email addresses, phone numbers and public IPs are identifying rather than exploitable but still worth covering before something goes public.
Will it catch everything?
No, and it says so rather than implying otherwise. It matches known shapes — a string starting sk_live_, a number that passes the Luhn check — so a bespoke internal token with no recognisable form will not be flagged. Read the picture yourself as well; this is a second pair of eyes, not a replacement for the first.
Is my screenshot uploaded to check it?
No. Text recognition runs in this tab using a recogniser downloaded to your browser. That is not a nicety here, it is the entire point: a service that asked you to upload screenshots full of credentials in order to find the credentials would be a worse problem than the one it solves.
Can the covered parts be recovered?
No. The regions are filled with solid colour on the pixels themselves before the file is written, so there is no layer to peel back and nothing blurred to reverse.
Does it remove the file’s metadata too?
No, that is a separate job. Covering something in the picture does nothing about the tags in the file, so run it through Remove Metadata afterwards if it came off a phone.