Redact an API Key Before You Share a Screenshot
A leaked key is the rare screenshot that turns into an invoice. The characters are long and awkward, which is exactly why people crop one carelessly and publish a usable credential.
Free, no account, and the image never leaves your browser.
Why a key in an image is urgent in a way other fields are not
An API key is an authenticated capability. A name identifies a person; a key spends money, reads a database, or sends mail as you. Providers bill for the usage, and abuse often begins within minutes of a public post because automated scanners watch code hosts and social feeds for the prefixes.
The shape makes cropping unreliable. A key like sk-proj-... runs 100 to 200 characters, and a screenshot usually shows it wrapped across two lines, partially scrolled, or truncated with an ellipsis by the interface. The part you can see is frequently the part that is still valid.
There is a second leak nobody crops. Terminal screenshots show the export line or the config file path, and the value is reprinted inside a request header block lower in the log. Covering the first occurrence leaves the working credential on screen.
What to cover on a page that shows a key
The key is the obvious target. The context around it tells an attacker which provider to try it against.
- The full value, every line it wraps onto
- A long key breaks across lines in a terminal or a settings panel. Cover the whole run, including the fragment after a visible line break.
- The prefix and the provider label
- sk-live, AKIA, ghp_, AIza and a field caption such as 'OpenAI API key' all identify which service the value authenticates to.
- Account and project identifiers
- Project IDs, account numbers, and key names are not secret on their own, but they narrow a probe from every account to one.
- Base URLs, hostnames, and endpoints
- A private API host in the same panel tells an attacker where to send the credential and what version of the interface to target.
- Any second copy in the log
- Request headers, retry output, and quoted history repeat the value. Scroll the full frame before exporting.
- Related secrets on the same screen
- Webhook signing secrets, refresh tokens, and SMTP passwords usually sit within a few rows of an API key in a settings panel.
What the built-in detection will and will not find
Auto-detect reads the text in the image in your browser, then matches it against three well-known key shapes. It is a helper for the common cases, not an audit of your secrets.
Found automatically
- OpenAI-style keys: sk- followed by at least twenty letters or digits
- AWS access key IDs: AKIA followed by sixteen uppercase letters or digits
- Classic GitHub personal access tokens: ghp_ followed by thirty-six characters
- Each occurrence on the page, reported as a separate box
Needs a box by hand
- Keys with prefixes the matcher does not know: gho_, ghs_, github_pat_, AIza, xoxb-, xoxp-, pq:, dnb:, and provider-specific formats added after this page was written.
- Generic bearer tokens, JWTs, session cookies, and high-entropy strings that carry no recognizable prefix.
- A value the recognition pass splits across a line break. The matcher needs the prefix and the body to read as one continuous string.
- Keys printed in a monospaced font at small size or low contrast, where an O reads as a 0 and the pattern no longer matches.
- Truncated display values such as sk-...9f3c, which are not the credential but still hint at the provider.
Removing the key, step by step
Under a minute for one screenshot. If the key was already public, revoke it first — the screenshot is the smaller problem.
Revoke before you publish, if it was already out
Redaction cannot un-leak a key. Rotate the credential at the provider, then treat the screenshot as a document about a dead value rather than a live one.
Load the screenshot
Drop, paste with Ctrl/Cmd+V, or choose a file. It is decoded in the tab and never sent anywhere.
Run auto-detect, then read its output sceptically
A missing box means nothing at all — absence of a flag is not evidence of absence. Check every character run on the page yourself.
Box the value with margin, on every line it occupies
Drag past the first and last characters on all sides, and box each line of a wrapped key separately. Tight boxes leak the edge characters.
Use solid black, never mosaic
Pixelation averages pixels into blocks, and long character runs keep enough stroke information to be reconstructed at zoom. A fill replaces them.
Export and inspect the PNG at 100 percent
Open the downloaded file, not the editor. Check the edges of each box and the tail of the frame for a second occurrence.
Why a fill is the only defensible style here
A key is a high-entropy string with a known verifier. That combination is worse than an SSN: a degraded image that leaves a partial shape can be tested directly against the provider's API, so any candidate that resolves is confirmed rather than guessed. Anything that averages rather than overwrites leaves that door open.
A solid fill replaces the pixels inside the box with a single color in the destination canvas. The characters are not encoded, compressed, or pushed into another channel — they are gone from the file, at every zoom level, permanently.
The blur option on other tools is actively misleading for this field. A blur applied to a terminal font preserves the spacing rhythm and the stroke positions of every glyph, which is most of what distinguishes one character from another at that size.
One practical note on the pixelate mode this tool offers: it paints an opaque base first and then a mosaic, so nothing shows through the fill. It still uses original pixels at reduced resolution, which is why the recommendation for a credential is the plain black fill.
Settings panels and terminal captures rarely show one secret. You can redact image online with as many boxes as the frame needs, on a canvas that stays in the browser tab the whole time.
Frequently asked questions
Is it safe to show only the first few characters?
For a support post it is common practice, and the prefix plus a tail is generally not enough to use a key. It still tells a scanner which provider to target, so cover the prefix too if the screenshot is going somewhere public.
Auto-detect found nothing. Does that mean my key is covered?
No. Detection only knows three shapes. A missing box means the pattern did not match — check the image by hand and draw the boxes yourself.
Should I still rotate a key I covered properly?
If the key was ever displayed on a screen that reached a third party, rotate it. Redaction protects the file you are publishing now; it does nothing about the copies that already exist.
Does the tool upload or store the screenshot?
Neither. There is no upload path, no server processing, and no storage. Reloading the page discards the image, and there is no account to attach it to.
Will the exported file keep the terminal's metadata?
The export is a new PNG encoded from a canvas. Container metadata from the source file does not survive the rebuild.
Can I use this on a photo of a monitor?
Yes, though recognition drops sharply on a photograph because of moiré, angle, and contrast. Expect to place the boxes by hand and verify at full zoom.