Remove API keys and tokens from screenshots
Redacting a screenshot prevents a credential from spreading further; it does not make an exposed credential trustworthy again. If a real API key, token, password, private URL, cookie, or connection string reached an unintended person or location, revoke or rotate it first, then sanitize the image.
Put this guide into practice: Redact a screenshot. Paste or open an image, then review it before sharing.
About this guide
By Derek Brumby · Product behavior checked with synthetic FreeRedact test files
Published · Updated · 10 minute read
How this guide was checked
The visual workflow was checked with synthetic terminal, browser developer-tools, API-client, environment-panel, and error-report screenshots. Every credential-like value is explicitly nonfunctional.
The process below uses only fictional sample information. Test the workflow with harmless data before relying on it for a sensitive file.
Contain first, edit second
Assume a real credential is exposed when it appears in a public post, shared ticket, chat, screen recording, or repository available to people who should not have it. Use the issuing service to revoke or rotate it, update dependent systems, and inspect relevant logs according to your incident process.
Deleting or redacting the screenshot is still worthwhile, but it is cleanup rather than containment. Copies, caches, notifications, previews, and downloads may already exist.
Search beyond obvious key formats
Some providers use recognizable prefixes, but many secrets look like ordinary random text. Review labels, context, and neighboring values. A private link can grant access without looking like a key, and a session cookie may be more powerful than the API token you noticed first.
- Authorization, bearer, token, secret, password, api_key, client_secret, cookie, and session labels
- Request headers, response bodies, query strings, copied curl commands, and GraphQL variables
- Environment-variable panels, terminal history, logs, stack traces, and CI output
- Database URLs, cloud credentials, SSH keys, webhook URLs, and signed download links
- QR codes or barcodes that encode enrollment or authentication information
Reduce exposure before capture
Prefer a recreated screenshot with fake values over editing a production capture. Collapse headers and environment panels, clear the terminal, disable command echo where appropriate, and use provider-supported secret masking in CI logs. Capture only the line or panel needed to explain the problem.
Never paste a real credential into a demo solely to show what should be redacted. Use a clearly labeled placeholder that cannot be mistaken for a live value.
Redact the value and enough surrounding context
Cover the complete secret with a small margin. If the credential continues onto a wrapped line, redact every segment. Consider whether the account name, endpoint, tenant ID, repository, hostname, or response data also creates risk.
Keep generic error codes and sanitized request structure when they are necessary for troubleshooting. Written context is often safer than a wide screenshot of a live console.
Tested workflow
Revoke or rotate any real exposure
Use the credential issuer's documented process, update dependent services, and record the event according to your incident-response policy.
- Old credential is invalid
- Replacement is deployed safely
- Relevant access is reviewed
Recreate with synthetic values when possible
Repeat the non-sensitive error with a placeholder or crop the source to the minimum area. Close unrelated panels before capture.
- No live secret is used
- The error remains understandable
- Headers and environment panels are minimized
Redact, export, and inspect
Cover every credential-like value and any unnecessary infrastructure detail, download a new image, and zoom into wrapped lines and character edges.
- Every line segment is covered
- Private URLs and QR codes were checked
- Only the sanitized file will be shared
Example: Synthetic API error
A fictional API client shows a useful 401 response, request headers, and a deliberately nonfunctional demo token.
The fictional source contains
POST https://api.example.test/v1/demoAuthorization: Bearer DEMO_NOT_A_REAL_TOKEN_7Q4MResponse: 401 invalid audienceRequest ID: DEMO-4821
Redact
- DEMO_NOT_A_REAL_TOKEN_7Q4M in the header and any repeated copy
- Private hosts, tenant names, cookies, or payload values not needed for diagnosis
Keep when needed
- 401 invalid audience
- The safe example.test endpoint
- DEMO-4821 if it is a synthetic support reference
Expected result: A recipient can diagnose the fictional audience error without receiving a credential-like value or production infrastructure detail.
Verification checklist
Run these checks against the downloaded file, not only the editor preview.
- Confirm any real credential shown previously has been revoked or rotated.
- Review headers, query strings, payloads, terminal history, environment panels, and logs separately.
- Check wrapped and horizontally scrolled lines for additional secret characters.
- Inspect QR codes, barcodes, private URLs, and signed links.
- Zoom to at least 200% and confirm every redaction is fully opaque.
- Open the actual exported attachment and verify no original capture is bundled with it.
- Do not upload a real secret to an online decoder or validation service during review.
Limitations and decisions that remain yours
- Pattern matching cannot identify every provider-specific or custom secret format.
- A sanitized screenshot does not invalidate a credential or remove copies already shared.
- Account names, endpoints, request IDs, timestamps, and response bodies can reveal infrastructure even without a secret.
- Incident-response, audit, and notification requirements depend on the service and organization.
Sources and further reading
These sources support the file-format and privacy practices discussed above. Product-specific behavior is described from FreeRedact’s documented workflow and synthetic tests.
Related guides and tools
Ready to check a file?
Open FreeRedact, review every suggestion, add anything the scan missed, and inspect the downloaded copy before sharing. No signup is required.
Redact a screenshot