How to hide customer data in product screenshots

People usually reach for blur because it looks tidy and takes a second. For a stranger's face in a background photo, that may be enough. For an email address, an invoice total or a customer's name, it's the wrong tool.

Which method to use

Why blur can be reversed

A blur doesn't delete anything. It replaces each pixel with a weighted average of its neighbours, using a fixed formula. The information is smeared, not gone. That opens two lines of attack.

Undoing the sum. If you know or can estimate the blur's settings, you can attempt to run it backwards. This is known as deconvolution. Noise and compression make the result imperfect, but text is simple to work with: high contrast, on a plain background, in a known typeface.

Guessing and comparing. This one is easier, and it doesn't reverse anything. An attacker types a guess in the same font and size, applies the same blur, and compares it with your image. The closest match wins. Screenshots suit this badly for you, because software interfaces use standard fonts at standard sizes, and the attacker can often work out which ones from the rest of the screen.

Your data makes it easier still. Email addresses follow a pattern. Invoice amounts are digits and a currency sign. A short list of customers or first names can be tried in full. The shorter and more predictable the text, the less it takes to guess. A paragraph is hard to recover. A four-digit code is not.

Pixelation is not much better

Pixelating looks more final than blur, and with large blocks it does throw away more. But each block is still an average of what's beneath it, and the same guess-and-compare method works.

The evidence here is good. Researchers at UC San Diego, in a 2016 paper, recovered text from both mosaiced and blurred images, including real-world examples, and concluded that both "are not viable approaches for text redaction". In 2022, Dan Petro at Bishop Fox released Unredacter, used it to recover the text of a public pixelation challenge, and concluded: "use black bars covering the whole text. Never use anything else." Depix is another public proof of concept for recovering text from pixelated screenshots.

So pixelation is safer than a light blur only in a loose sense. Larger blocks leave less to work with, but we can't give you a block size that makes it safe. For anything that matters, it isn't the right choice.

Do it properly: use data that isn't real

The surest way to hide a customer's data is to never have it on screen.

• Keep a demo workspace. Seed it with realistic records and capture everything there. It takes an afternoon once, and then each capture is safe by default. Libraries such as Faker can generate names and addresses.
• Change it in the browser. For a one-off, open your browser's developer console and run document.designMode = "on". MDN explains that this makes the whole document editable. Click any text and type over it, then capture. The change is only in your browser and goes away when you reload. It works for text, not for charts or images, and anything that redraws itself will bring the real text back, so check before you capture.

Made-up data needs care too. Don't use the real name of a company or a person by accident, and use reserved addresses such as [email protected] so nobody receives a stray email.

When you must cover real data

Sometimes the screen can't be recreated. Then use a filled rectangle at full opacity in any image editor, such as Preview, Paint, Figma or Photoshop.

1. Draw the box well past the edges of the text. Its width shouldn't reveal the length of the name.
2. Use a solid colour with opacity at 100%.
3. Cover any part of the detail that repeats elsewhere, such as a name in the page title or an initial in an avatar.
4. Export a new flat PNG or JPEG. Don't share the source file.
5. Open the exported file and check it.

Covering the pixels only helps if the data has really left the file. Bishop Fox makes a similar point: black text on a black background isn't a redaction, because the text is still there. In PDFs, a drawn box can leave the text selectable underneath. Export as an image, or use a proper redaction tool.

Cropping has a trap as well. In 2023, the aCropalypse flaw showed that Google Pixel's Markup tool left the end of the original file behind when cropping a screenshot, so part of the removed area could be recovered. The bug was fixed in March 2023, but images already shared stayed exposed. The safe habit is to take a new capture of just the area you need, rather than trusting a crop.

Where private data hides in a screenshot

Most leaks aren't in the main table. Go through this list on every capture.

• Browser: tab titles, the address bar (IDs and search terms), bookmarks, profile picture and autofill suggestions.
• Sidebar and header: workspace name, account switcher, your own name and email, recent items, avatars.
• Notifications: toasts, unread counts, desktop alerts from Slack or email sliding in.
• Charts: tooltips, axis labels with real revenue, customer names in the legend.
• Tables: the row you scrolled past that's half visible, a filter box with a name typed in.
• Developer tools: API keys, tokens, webhook URLs and internal hostnames. Rotate any key that's shown, even if you later cover it.
• Pictures on the page: a screenshot within a screenshot, or a document preview.

Real names are personal data, and the UK regulator's guide calls a name "perhaps the most common means of identifying someone". We aren't your lawyers, but it's worth checking your customer contract before showing a client's logo or data at all.

Video needs more care than a still

Even a 30-second film at 24 frames a second has 720 frames, and one is enough. Record in a demo workspace, because blurring a moving item means tracking it through every frame. Watch out for scrolling, since each frame shows the same blurred text at a slightly different position, and in principle that gives an attacker more to compare against. Also watch for auto-complete dropdowns that appear for a moment, and toasts that were on screen for less than a second. Step through the export frame by frame around any transition, or at the very least at a quarter speed.

Using Programmable Capture

The Capture extension has two tools, and they aren't equally strong: Blur disguises, and Hide covers.

• Blur works on the live page. Click a name, email or figure before you capture, or blur every email on the page in one click. It's a 6-pixel CSS blur, it stays until the page reloads, and Clear all takes it off. Treat it as a quick way to keep details from casual eyes, and not as redaction. The one-click option finds email addresses only, so names and figures still need clicking.
• Hide, in the mark-up screen, changes the picture itself. It draws a solid black box over the area, so those pixels are gone from the saved image rather than disguised. Save replaces the capture in the tray. Download saves a PNG and leaves the tray copy as it was, so press Save too if that capture is going to the studio.

For public material, capture from a demo workspace and use these tools as a second layer. The extension help article covers both. What you capture stays in your browser until you send it, so make the fixes before sending. Once a screen is in the product demo flow, the studio reads it to work out the story, so a name you missed could reach a caption. Check the storyboard as well as the film.

Check before you publish

1. View the final export, not the source, at 200% zoom.
2. Search each frame for names of real customers, and for your own name.
3. Check the file you're uploading is the flattened one.
4. Ask someone who wasn't involved to look for one minute.
5. Check the thumbnail and social preview, which can be a different frame.

If something gets out

Take the image or film down first, then find the copies: your CDN, YouTube, social posts, partner pages and any gallery you submitted to. Rotate any exposed key at once. Don't simply re-post a blurred version over a clear one, because old copies linger in caches. If customer data was exposed, tell whoever handles privacy at your company today, since legal deadlines can apply.

Common questions