Hide an Email Address in a Screenshot
Email addresses are the least dramatic thing on this list and the most frequently leaked. They appear in headers, sidebars, profile cards, and notification popups — and unlike a card number, there is no way to cancel one.
Free, no account, and the image never leaves your browser.
Why a visible address is a durable problem
A leaked card number can be cancelled in a phone call. An email address cannot. It is the account identifier for banking, work, social media, and password resets, and it is the delivery address for every phishing attempt that follows.
The specific mechanism matters. Once an address is public, it enters lists that are sold and reused. Those lists drive targeted phishing — messages that reference a real project, a real colleague, or a real invoice number, because the sender now knows where the person works and who they correspond with. A screenshot that also reveals an internal system name or a ticket number makes that message far more convincing.
There is a quieter problem too. Screenshots of a shared inbox, a support queue, or a CRM record contain dozens of addresses at once. Covering the one address you were asked about and leaving the rest of the list visible turns a single-person disclosure into a mailing list disclosure, and in some jurisdictions that is a notifiable data incident rather than an inconvenience.
Where addresses hide in a screenshot
The visible body text is the obvious place. Most leaks come from the chrome around it.
- The address in the message body
- The one you noticed. Cover the whole address, not just the local part before the @.
- Account switchers and profile chips
- The top-right corner of most web apps shows the signed-in address. It is small, grey, and easy to forget.
- Browser tab titles and the address bar
- Some applications put the account address in the document title, which means it is visible in the tab and in any window list included in the screenshot.
- Notification popups and toasts
- A toast that says a message was sent to an address will sit in the corner of the frame for a few seconds and is often captured.
- Reply-to and CC lines
- In an email screenshot, the collapsed header hides a list of recipients. Expanding it before capture is a common way to leak a whole thread's participants.
- Signatures and footers
- Contact blocks at the bottom of a message repeat the address, plus a phone number and a job title.
- Other addresses in the same list
- If the screenshot shows a table of users, cover every row you are not authorized to disclose, not just the row you were asked about.
Email detection is the most reliable pattern here
An address has a rigid shape: something, an @, a domain, and a dot-separated suffix. That makes it the pattern the recognition pass handles best — but reliability is not certainty.
Found automatically
- Standard addresses such as name@example.com
- Addresses with dots, plus signs, underscores, and percent signs in the local part
- Multiple addresses in a list or table
- Addresses in a signature block
Needs a box by hand
- Addresses that the recognition pass splits at a line break or a wide letter space. Recognition returns words separately, so an address broken across two visual runs may be rejoined with a space and fail to match.
- Addresses inside an image, such as a logo lockup or a screenshot of a screenshot.
- Obfuscated forms like name [at] example [dot] com, which are deliberately not matched.
- Addresses rendered in very low contrast grey, which is exactly how profile chips are usually styled.
- An address that is partially covered by another box you drew first.
A two-minute pass over a shared screenshot
Work from the edges inward. The body text is what you are focused on, and focus is why the corners get missed.
Open the screenshot
Drop, paste, or choose a file. PNG, JPEG, and WebP up to 25 MB and 40 million pixels.
Run auto-detect and check the count
The tool reports how many items it found, grouped by type. If the number is lower than the number of addresses you can see with your own eyes, do not trust the result — find the missing ones manually.
Use the type filter to isolate the email boxes
Detected boxes are grouped by type. Toggling a type off hides those boxes without deleting them, which is useful for checking whether you have covered everything else.
Sweep the four corners
Top-right for the account chip, top-left for the tab, bottom-left for notifications, bottom-right for toasts. This is where the missed addresses live.
Cover whole addresses
A partially covered address still reveals the domain, which identifies the employer. If the point is to hide who the person is, cover the domain too.
Export and read the result
Open the PNG at full size and check that no address is partially visible at the edge of a box. Solid black gives a clean edge to check against.
The domain is the part people forget
Most redaction advice focuses on the local part — the name before the @. That is understandable, since the name is the personal identifier. But the domain is often more identifying in a professional context. First.Last@company.com identifies a person and their employer; the domain alone narrows a public post down to one organization, and combined with a job title in a signature it is usually enough to find the person on a company page.
That is why covering half an address is a common and self-defeating move: the result looks private while still publishing the organization. Cover the whole string.
There is a structural reason the tool is useful for this specific job. Addresses repeat. The same address appears in the header chip, the message body, the signature, and the reply-to line of a single screenshot. Doing this by hand across four locations invites a miss; detection reports each occurrence as its own box, so you can see the count and reason about whether it matches what is on screen.
The honest limit is that detection reads text. It does not read the DOM, the image's alt text, or the underlying application. It sees what a person would see in the rendered picture — which is the right scope for a screenshot, and the wrong tool for an exported HTML file.
Frequently asked questions
- Can I cover just the name and leave the domain?
- You can, but be deliberate about it. The domain identifies the organization, and for a professional address that is often the part that reveals who the person is. If the goal is anonymity rather than simply hiding the inbox, cover the entire address.
- Does detection find addresses in a table?
- Yes, each address is reported separately. Note that cover means covering every row you are not cleared to disclose — detection finding twelve addresses does not mean you should only cover the one you were asked about.
- Why was an address split across two lines missed?
- The recognition step returns words individually and the tool rebuilds lines from them. An address broken by a line break or an unusually wide gap can end up joined with a space and fail the pattern match. Draw that box by hand.
- Does the tool send the text it recognizes anywhere?
- No. Recognition runs locally in your browser and the results stay in the page. The only network requests are the static library and language files the recognition engine needs, and those do not include your image or anything derived from it.
- Is there a limit on how many boxes I can draw?
- There is no limit in the interface. Very large images with a few hundred boxes will feel slower to redraw, since the canvas is repainted on each change.