How to redact a screenshot in Chrome

You need to send a screenshot of a page that has a customer's email on it, or your own API key, or a colleague's phone number. Here are three ways to get it out of the image, ordered from "works everywhere but slow" to "one click".

Method 1: capture first, black out in an image editor

This is what most people do, and it works as long as you use a solid box rather than a blur.

• Windows: press Win+Shift+S, take the shot, click the notification to open Snipping Tool, then use the rectangle highlighter with a solid color, or paste into Paint and draw a filled rectangle.
• macOS: press Cmd+Shift+4, open the screenshot in Preview, then Tools → Annotate → Rectangle and set the fill to black (the "Redact" tool exists in Preview on newer macOS versions too).
• Any OS: paste into any editor with a filled-rectangle tool.

The downside: it's slow, you have to spot every item yourself, and the original unredacted image is still in your clipboard history and possibly on disk.

Method 2: edit the page before you capture (the DevTools trick)

Because a web page is just text, you can change it before taking the shot. Right-click the sensitive text → Inspect, double-click the text in the Elements panel and type something else (or delete it), close DevTools, then take the screenshot. The page only changes locally; reloading brings the real content back.

This is handy for one or two items, and the result is clean: no boxes at all. It's tedious for a page with ten items, and easy to miss text inside inputs, tables or side panels.

Method 3: redact automatically before capture

Cloakshot is a Chrome extension that scans the page for sensitive patterns, covers them with black boxes on the page itself, and only then captures. Because the boxes are drawn before the pixels exist, there is nothing to recover from the image, and nothing is uploaded anywhere.

1. Click the Cloakshot icon (or press Alt+Shift+S).
2. It blacks out emails, phone numbers, card numbers (Luhn-validated), CPF/CNPJ, SSN, IBAN, API keys and tokens, JWTs, password= values and IP addresses. Form fields containing any of those are covered whole.
3. Missed something? Manual mode (Alt+Shift+M) lets you click any element or word to black it out.
4. Review in the editor, drag to add boxes, then copy to clipboard or download a PNG.

Names and street addresses are not detected automatically (that needs language understanding, not patterns), so use manual mode for those, or add them as keywords in Pro.

Checklist: what people forget to redact

The simplest defense is to capture only the visible area of the page content, not the whole screen, so the browser chrome (tabs, bookmarks, address bar) is never in the image. Both DevTools' "Capture screenshot" and extension-based capture do this.

Which method should you use?

• One-off, one item: Method 2 (DevTools) gives the cleanest result.
• Occasional, you have an editor open anyway: Method 1, with solid boxes.
• Several times a week, or the data is regulated (customer PII, health, finance, HR): Method 3, because the point is to make it impossible to forget.