What is in this screenshot?
Reads a screenshot and points at the API keys, tokens, card numbers and addresses in it, then covers the ones you pick.
- Add
- Adjust
- Make
- Keep
How to use this tool
- Add your files — drag them onto the page or choose them. They stay on your device.
- Add the file you are about to publish or send.
- The checker reads the file's hidden layers — EXIF fields, XMP and IPTC blocks, comments and text chunks — flags embedded GPS, and runs pattern detection for emails, card numbers, cloud keys, tokens and private keys, with nothing sent anywhere.
- Press “Process files” and download the results, individually or as one ZIP.
About this tool
Reads a screenshot and points at the API keys, tokens, card numbers and addresses in it, then covers the ones you pick. Nothing is uploaded. Everything is analysed and produced on your own device — nothing is uploaded anywhere, and you can verify it: the tools keep working even offline.
Privacy & limitations
Detection is pattern-based: it finds what secrets usually look like and can miss bespoke identifiers; a clean report means no known pattern matched, not that the file is provably innocent. It does not read the visible pixels: an address or key that only appears on screen in the picture is not detected — run Image to Text on the screenshot and check that text as well.
Last updated:
Frequently asked questions
What counts as a leaked secret in a screenshot?
Anything that authenticates or identifies. API keys and tokens are the serious ones because they can be used immediately; card numbers and bank details follow; email addresses, phone numbers and public IPs are identifying rather than exploitable but still worth covering before something goes public.
Will it catch everything?
No, and it says so rather than implying otherwise. It matches known shapes — a string starting sk_live_, a number that passes the Luhn check — so a bespoke internal token with no recognisable form will not be flagged. Read the picture yourself as well; this is a second pair of eyes, not a replacement for the first.
Is my screenshot uploaded to check it?
No. Text recognition runs in this tab using a recogniser downloaded to your browser. That is not a nicety here, it is the entire point: a service that asked you to upload screenshots full of credentials in order to find the credentials would be a worse problem than the one it solves.
Can the covered parts be recovered?
No. The regions are filled with solid colour on the pixels themselves before the file is written, so there is no layer to peel back and nothing blurred to reverse.
Does it remove the file’s metadata too?
No, that is a separate job. Covering something in the picture does nothing about the tags in the file, so run it through Remove Metadata afterwards if it came off a phone.