Loading Snapframe…
That terminal, .env, Postman or CI-log grab you're about to paste into a PR still has a live key in it. One click blurs detected keys, tokens and long secret strings — right in your browser, never uploaded. Then rotate the key too.
It matches known key prefixes and long opaque strings — a strong first pass. Short IDs and anything unusual are on you to box.
Recognises common key shapes by their prefix: Stripe sk_/pk_/rk_, GitHub ghp_, Slack xoxb/xoxa/xoxp, and generic api_/key_/token_. If it starts with a known secret prefix, it gets flagged.
Any unbroken 28+ character string of letters, digits, _ and - is treated as a secret — which catches AWS secret access keys, JWTs, base64 tokens and GOCSPX- Google client secrets even without a tidy prefix.
The same pass covers emails, phone numbers, IBANs, payment cards and US SSNs — the account details that ride along in a dashboard or billing screenshot.
Short unprefixed IDs like an AWS access-key ID (AKIA…, 20 chars) won't trip the length rule. Cover those yourself by dragging a box — the manual backstop for anything the detector can't know.
Paste from the clipboard, drag the PNG in or tap to browse — the terminal, dashboard, Postman or CI-log screenshot loads right in your browser. Nothing is uploaded.
One click reads the image and blurs detected keys, tokens and long secret strings. Eyeball the result and drag a box over any short ID or value it didn't flag.
Download a clean PNG with the blur baked in — no layer to peel back. Then rotate the key too: redacting the picture doesn't un-share a secret that was already visible.
The classic mistake: you paste a terminal, dashboard or Postman screenshot into a PR, Slack thread, GitHub issue or Stack Overflow answer to show a bug — with a live token sitting right there in the output. Secret scanners and OCR bots crawl images too, so a key in a picture is a key in the wild.
Auto-Redact reads the image in your browser and blurs the key shapes it recognises — prefixed keys and long opaque strings. It's a strong first pass, not a guarantee: check the result, drag a box over any short ID it couldn't know was a secret, and remember to rotate a key that was ever shown. The blur is baked into the export — no layer to peel back.
On-device, permanent, and honest that a redaction is not a rotation.
OCR and blur run locally on your device — the screenshot with the live key in it is never uploaded to a server. There's nothing sitting in someone's logs to leak later.
Redactions are flattened into the exported image. There's no hidden layer with the real key underneath for a reviewer, a scraper or a git history to peel back.
Blurring the screenshot stops the leak spreading, but a key that was ever posted should be considered burned. Rotate it in the provider dashboard; treat redaction as damage control, not a fix.
Which key shapes Auto-Redact catches on its own, what still needs a manual drag, and why a redaction is not a rotation.
It flags strings that start with a known secret prefix — Stripe sk_/pk_/rk_, GitHub ghp_, Slack xoxb/xoxa/xoxp, and generic api_/key_/token_ — plus any unbroken 28+ character string of letters, digits, underscores and dashes. That length rule catches AWS secret access keys, JWTs, base64 tokens and GOCSPX- Google secrets even without a prefix. Short unprefixed IDs like an AWS AKIA access-key ID should be covered manually by dragging a box.
No. Redacting the image only stops the leak spreading further. If a live key was ever visible in a screenshot you shared, treat it as compromised and rotate it in the provider's dashboard. Snapframe hides the pixels; it can't un-share a secret or revoke it for you.
No. The text recognition and the blur both run in your browser on your own device, so the screenshot — key and all — is never uploaded to a server. There's nothing stored remotely to leak.
No. The blur is baked into the exported PNG, JPG or WEBP — there's no hidden original layer underneath. The covered characters are gone from the file you paste into the PR, issue or chat.
Because secret scanners and OCR bots read images too. A key pasted into a public GitHub issue, Stack Overflow answer or Slack export can be lifted from the picture and used within minutes. Blur it before you post, and rotate it if it was ever shown.
The full playbook for clean, safe screenshots in docs, PRs and bug reports.
Developer guideFramed, sharp shots for your README — with secrets blurred before they hit the repo.
README shotsTurn a snippet or terminal into a crisp, shareable image — redact the sensitive lines first.
Code shotsThe hub: emails, cards, IBANs, SSNs and phone numbers — not just keys — blurred in your browser.
Redaction hubFree, runs in your browser, no signup — your screenshot never leaves your device. Then go rotate that key.