Is pixelating or blurring a password in a screenshot safe?
A pixelated card number or blurred password looks unreadable, but the blur is a fixed recipe. If an attacker can guess the font and the kind of text (four digits, an email address, a card number), they can try every answer and keep the one that blurs into the same squares.
Why a blur can be undone
Pixelating splits the area into squares and paints each square with the average colour of the pixels underneath. Blurring mixes each pixel with its neighbours. Both throw detail away, but they do it the same way every time. That is the weakness: you don't need to reverse the blur, you only need to repeat it.
- Guess the font and size, which is easy for a screenshot because apps and websites use a handful of standard fonts.
- Write every possible answer the same way: all 10,000 four-digit PINs, all 16-digit numbers that start with the bank's prefix, or likely words.
- Pixelate or blur each guess with the same square size, line it up, and compare. The guess whose squares match the screenshot is the hidden text.
Short, predictable text falls fastest. Long random passwords are harder, but a screenshot often gives away the length, the font and a few letters at the edges, which shrinks the search.
How the common methods compare
| Method | Safe? | Why |
|---|---|---|
| Crop the part out | Yes | The pixels are gone, as long as the app really saves a new file (see the cropping bug below). |
| Solid box, 100% opaque, flattened | Yes | Every pixel underneath is replaced by one colour, so nothing is left to compare. |
| Pixelate / mosaic | No | Each square keeps the average colour of the text under it; guesses can be matched. |
| Blur | No | A repeatable mix of neighbouring pixels; guesses can be matched, and light blur is often readable by eye. |
| Swirl or twirl | No | A twist can be twisted back. Police famously recovered a face from a swirled photo this way. |
| Highlighter or a see-through shape | No | Raising the contrast in any photo editor usually makes the text underneath readable. |
| Thin scribbles with a pen | Risky | Gaps between strokes leave parts of letters visible. Use a shape or thick strokes that fully cover it. |
| Emoji sticker in an app | Usually yes, once saved | Fine if the exported file has the sticker burned in. In some apps the sticker is a separate layer until you export. |
Things that leak around the box
- The edit isn't saved into the file yet. Some editors keep your box as a separate layer, and the original stays inside the document. Export to a new PNG or JPEG, or take a fresh screenshot of the edited picture, then share that.
- The cropping bug. In 2023 it came out that the Google Pixel Markup tool and the Windows Snipping Tool could save a cropped picture over the original file without removing the old data at the end, so the uncropped picture could be partly rebuilt. Both have been fixed by updates; keep your apps updated, and save edits as a new file when you can.
- The same thing elsewhere in the picture. A hidden email address may also appear in a tab title, a notification, an address bar or a reflection.
- Hidden notes in the file. Photos (not usually screenshots) can carry a location and phone model; check with the photo metadata viewer.
Check your own picture before you send it
- Open the exact file you are about to send, not the one in your editor.
- Zoom right in on the covered area: it should be one flat colour with no faint shapes.
- Brighten it or raise the contrast in any editor; nothing should appear.
- If it is a PDF, try to select or search the covered words (see redacting a PDF).
Related
Redact a PDF properly (black boxes that don't hide anything) · Hide private info in a screenshot before you share it · Check if a photo shows your location · Why compressed photos get blocky · Try it: pixelate a pretend PIN and watch it get found
Questions
Can pixelated text be recovered?
Often, yes. If the font and the kind of text are guessable, an attacker can pixelate every likely answer the same way and find the one that matches. Published tools such as Depix and Unredacter do this for screenshots.
Is blurring a password in a screenshot safe?
No. Blur is a repeatable recipe just like pixelation, so guesses can be blurred and compared. Light blur is sometimes readable by eye. Cover it with a solid box or crop it out instead.
Is a black highlighter enough?
Only if it is fully opaque and saved into the file. Most highlighters are partly see-through, and raising the contrast shows the text underneath.
What is the safest way to hide text in a screenshot?
Crop it out, or draw a solid, fully opaque box over it and export a new copy of the picture. Then zoom in on the copy you are sending to check nothing shows.
Does a long random password survive pixelation?
It is much harder to recover than a PIN, but the screenshot still reveals its length, the font and often a few letters at the edges. Change any password that has been shared in a screenshot, covered or not.
Published .