What a screenshot gives away
There is no GPS in a screenshot and no camera data, because no camera was involved. The metadata question, which is what most articles answer, has a short and reassuring answer. The risk is the part you can see and did not look at: the other tabs, the notification that arrived, the email address in the corner, the Wi-Fi name, and the session token sitting in the URL bar.
Written · Updated
The metadata in a screenshot is mild: a timestamp, the pixel dimensions, sometimes the operating system and the app that took it. There is no GPS in one and no camera data, because no camera was involved. The risk is the part you can see and did not look at: the other browser tabs, the notification that arrived, your email address in a toolbar, the Wi-Fi name in the menu bar, the file path, the account photo, the order number. SCREENSHIELD blacks those out in your browser, and X-RAY shows the metadata that is actually in the file. Neither uploads it.
What is in the file
A screenshot is generated by your computer rather than captured by a lens, so most of what makes a photograph revealing is simply absent. What remains is usually:
- When it was taken. A creation timestamp, and on some platforms a modification one as well. This is the item most worth knowing about, because it can contradict a story: a screenshot said to be from Tuesday that carries Thursday's timestamp is a fact somebody can check.
- The dimensions, which give away the display it came from. A 2556×1179 PNG is an iPhone 15; 3024×1964 is a 14-inch MacBook Pro. It identifies a class of device, not a device.
- The software. Often the operating system's screenshot service or the tool used, written into the PNG's metadata.
- Sometimes a colour profile naming the display model.
What is not there: GPS coordinates, camera make and model, lens, exposure, serial number. Those live in EXIF written by a camera, and a screenshot has none.
One real exception: a screenshot of a photograph does not carry the photo's EXIF (which is why screenshotting an image is a crude but genuine way to strip its location), but a photo you take of a screen with your phone is a photograph and carries everything a photograph carries, including where you were standing.
The part that actually catches people
Nearly every real incident involving a screenshot is about what was visible on screen and went unnoticed because the person was looking at the one thing they meant to share. In rough order of how often it happens:
| Where | What it gives away |
|---|---|
| Other browser tabs | What else you were doing, internal tool names, a client's name in a title |
| A notification banner | A message from somebody, and who they are, in full |
| The toolbar or profile corner | Your email address, your real name, the organisation |
| The menu bar or system tray | The Wi-Fi network name, the VPN, the battery, the clock in your timezone |
| The URL bar | A session token, an internal hostname, a document ID, a query you had typed |
| The window title or file path | Your username, the folder structure, a client or matter name |
| The taskbar or dock | Which applications you run, which says a lot about the organisation |
| The scrollbar | How much more there is, which is sometimes the point being hidden |
The URL bar deserves its own line. Password reset links, magic sign-in links, pre-signed file URLs and session tokens all live in the address bar, and all of them are credentials in the plainest sense: anybody with the string is signed in as you. A screenshot showing one is not a privacy lapse, it is a handover.
Blurring and pixelation do not always work
Two ways they fail, and both have produced real recoveries.
- Pixelation of a known alphabet is reversible. If the hidden thing is text in a familiar font, an attacker can render every candidate string, pixelate each one the same way, and compare. This has been demonstrated end to end against redacted documents and against pixelated text in screenshots. It works because pixelation is a deterministic function, not a one-way one, and the space of possible account numbers or names is small.
- A swirl or a blur can be undone. A reversible transform is reversible; the case that made this famous ended in a conviction after the swirl applied to a face was unwound.
The safe operation is a solid opaque block, painted into the pixels and exported as a new image. SCREENSHIELD offers both and the black box is the one to use when the content matters; pixelation is fine for making a face less recognisable at a glance and is not a redaction.
Cropping is not removing, on some platforms
Worth checking on whatever you use. There have been repeated cases where an operating system's crop was stored as an instruction rather than applied to the file, so the original full image remained inside and could be recovered by anything that ignored the crop, the best-known being the "aCropalypse" bug in Android's Markup and in Windows Snipping Tool in 2023, where cropping a screenshot left the discarded pixels in the saved PNG.
Both were patched, but the lesson generalises: a crop or an annotation applied by an editor is not guaranteed to have removed anything. Exporting a fresh image built from the pixels you want to keep is guaranteed, and it is what a redaction tool should do.
A short routine before you send one
- Capture the region, not the screen. Most of the list above is eliminated by selecting just the window or area you mean. This is the single highest-value habit here.
- Look at the four edges before anything else. Menu bar, taskbar, tab strip, the profile corner.
- Read the URL bar as a stranger would.
- Black out, do not blur, anything that is text and matters.
- Export a new file rather than saving over, so a crop is genuinely a crop.
- Strip the metadata if the timestamp is sensitive: SCRUB or CLEANROOM.
All of it in the tab you have open: a screenshot is usually a picture of something you were not meant to be circulating, and uploading it to a redaction site to make it safe is the wrong order of operations.
And for the commonest reason people take one at all (a demo, a template, a bug report, a screenshot for documentation), the better answer is further back than redaction. Do not capture real data and then hide it; fill the screen with data that was never real. FAUX generates plausible people, addresses, card numbers and records for exactly that, so there is nothing to black out and nothing to miss.
Questions people ask about What a screenshot gives away
Do screenshots contain metadata?
Some, and much less than a photograph. Typically a creation timestamp, the pixel dimensions, often the operating system or tool that made it, and sometimes a colour profile naming the display. There is no GPS and no camera data, because no camera was involved; those live in EXIF written by a lens.
Can a screenshot reveal my location?
Not through coordinates; there are none in the file. It can reveal it through what is visible: a Wi-Fi network name in the menu bar, a clock in your timezone, a weather widget, a delivery address on the page, or a map that happens to be open in another tab.
Does a screenshot of a photo keep the photo's GPS data?
No. The screenshot is a new image generated by your computer and carries none of the original's EXIF, which is why screenshotting a picture is a crude but genuine way to strip its location. The reverse is not true: a photograph you take of a screen with your phone is a photograph, with everything a photograph carries.
Is pixelating text in a screenshot safe?
No, when the text is from a known alphabet in a familiar font. Pixelation is a deterministic transform, so an attacker can render candidate strings, pixelate them identically and compare, which has been demonstrated against both documents and screenshots. The space of possible account numbers or names is small enough for it to work. Use a solid opaque block.
What is the most common thing people miss in a screenshot?
The edges. Other browser tabs, a notification banner that arrived, an email address in the profile corner, the Wi-Fi name in the menu bar, the URL bar, and the window title carrying a username or a client name. Capturing the region rather than the whole screen removes almost all of it.
Can a URL in a screenshot be dangerous?
Frequently, and it is underestimated. Password reset links, magic sign-in links, pre-signed file URLs and session tokens all appear in the address bar and all of them are credentials: anybody with the string is signed in as you. A screenshot showing one is not a lapse, it is a handover.
Is cropping a screenshot enough?
It should be, and on some platforms it has not been. The aCropalypse bug in 2023 left the discarded pixels inside the saved PNG for screenshots cropped with Android's Markup and the Windows Snipping Tool. Both were patched, and the general lesson stands: export a fresh image built from the pixels you want to keep rather than trusting an editor's crop.
How do I black out part of a screenshot properly?
With something that paints an opaque block into the pixels and exports a new image, rather than drawing an annotation over it. SCREENSHIELD does that in your browser: drag boxes, choose a black box rather than pixelation when the content matters, and download a clean PNG. Nothing is uploaded.
Can you tell what device a screenshot came from?
A class of device, from the dimensions. 2556×1179 is an iPhone 15; 3024×1964 is a 14-inch MacBook Pro. That narrows it to a model, not to you, unless what is visible in the image narrows it further, which it usually does.
Should I strip the timestamp?
Only if it matters, and sometimes it matters a great deal: a screenshot said to be from one day that carries another day's timestamp is a checkable fact. If the timing is sensitive, remove it with SCRUB. If the screenshot is evidence, do the opposite: keep the original untouched and hash it.
Related tools
- Is it safe to upload a file to a free tool?It depends much less on the tool's promises than on one fact: the moment you upload, the file is a copy on somebody else's computer, and every…
- Is it safe to upload your bank statement?It depends who is asking, and “use a secure connection” answers the wrong question.
- Is it safe to upload your payslip?Everything written about payslips and privacy is about whether a company may email them to staff.
- Is it safe to send a medical letter or test result?Everything written about this is aimed at clinics, and none of it binds you as the patient.
- Sending a scan of your passport or licenceWhat the image is worth to a thief, which fields to black out for which purpose, why the watermark convention works, and why a redaction website is the worst place to prepare one.
- Is it safe to upload your CV?What to leave off, what a Word CV says about its author, and the hidden-text problem, including the copy you did not put there.
A letter, now and then
An occasional letter when there is something worth reading: the new guides and what changed in the tools. Never more than once a month and nothing else, and you can leave at any time on the unsubscribe page.