Redact API Keys From Screenshots Before You Share Them
Last reviewed: August 28, 2026
Share the bug, not the secret
A terminal, dashboard, commit, or browser screenshot can be useful in a bug report while also exposing an API key, bearer token, password, internal URL, or customer data. The safest option is to rotate an exposed secret first. Before you share the screenshot, PrivaCanvas can help you make a separate redacted PNG locally in your browser.
PrivaCanvas does not currently read text or automatically find keys. Draw the areas to hide yourself, then review the exported image. That keeps the workflow local and prevents an automatic scanner from being mistaken for a security guarantee.
How to redact an API key in a screenshot
- Copy the screenshot, then paste it into the PrivaCanvas editor with Ctrl/⌘ + V, or choose the saved image.
- Scan the whole frame: terminal tabs,
.envvalues, browser address bars, request headers, sidebars, notifications, and console output often contain unrelated secrets. - Select Blackout and draw a rectangle over each key, token, password, or exact identifier. Leave padding around the text.
- Zoom in, move or resize any mask that is too tight, and check line wraps or text below the visible fold.
- Download the new PNG. Reopen the downloaded file and inspect the exact copy you plan to attach to an issue, post, or chat.
If a live credential was already visible to someone unauthorized, treat it as exposed and rotate or revoke it through the provider. Redacting a later screenshot cannot undo the original exposure.
Why solid blackout is the default for secrets
Blur and pixelation preserve transformed versions of the original pixels. They can be suitable when visual context matters, but not for passwords, API keys, JWTs, private URLs, account numbers, or recovery codes. Blackout replaces the selected output pixels with a solid color, then the final PNG is flattened.
See Blur vs. Pixelate vs. Blackout for a practical comparison of the three methods.
A quick developer screenshot checklist
- Environment variables and
.envfiles - Authorization, cookie, and bearer-token headers
- API keys, JWTs, webhook signing secrets, and recovery codes
- Email addresses, usernames, customer IDs, and database URLs
- Private repository names, local file paths, and internal hostnames
- QR codes, browser profile menus, notification banners, and the desktop behind the captured window
Use the broader screenshot-redaction guide when the image contains names, addresses, chats, or other private details in addition to developer credentials.
Questions
Does PrivaCanvas send my screenshot to a server?
No. The editor opens the image and applies masks in your browser. PrivaCanvas does not provide an image-upload endpoint for this workflow.
Can the tool detect API keys automatically?
No. It has local face detection only; there is no OCR or key scanner. Manual review is intentional and remains necessary for every screenshot.
Does the exported file still contain movable masks?
No. The export is a new, flattened PNG. The blackout, blur, or pixelation is rendered into its pixels rather than saved as an editable overlay.