How to blur an API key in a screenshot (and what to do if it leaked)

The short answer

Cover the key with a solid box, not a blur. Paste the screenshot into Censor screenshot and keys, tokens and passwords are found and boxed automatically. If the key was in anything you already shared, rotate it: hiding it now doesn't make the old copy safe.

Why blur is the wrong choice for keys

Keys are short strings, in a monospace font, at a known size, in a screenshot that's usually a clean PNG. That's close to the ideal case for someone trying to reverse a blur or pixelation by testing candidates. Partial blur is worse: a few visible characters at either end shrink the search further.

A solid box replaces the pixels completely. There is nothing left to match. See Can blurred text be unblurred? for the details.

Don't leave the first or last few characters visible to show which key it was. Name the key in the text of your message instead, such as the staging key or the read-only key.

Cover keys step by step

1. Copy the screenshot and press Ctrl+V (Cmd+V on Mac) on Censor screenshot.
2. Secrets are highlighted: AWS, GitHub, Stripe, Google and Slack keys, JWTs, private keys, password assignments and long random-looking tokens.
3. Accept them, and drag boxes over anything that wasn't caught, such as a key that's cut off at the edge of the screen or split across lines.
4. Look beyond the obvious spot: .env files, config panels, connection strings, curl commands in your shell history and Authorization headers in dev tools.
5. Keep the style on Solid and download. The export is read again and anything still legible is flagged.

If the key was already shared

Treat any key that appeared in a shared screenshot, a recorded call, a public repository or a support ticket as exposed. Deleting the post or editing the image later doesn't help if someone already saw or saved it.

• Rotate it: create a new key in the provider's dashboard and update your app to use it.
• Revoke the old one once nothing depends on it.
• Check usage: look at the provider's logs or billing for activity you don't recognise.
• Narrow future keys: where the provider allows it, limit keys to the permissions and environments they need.

For everything else that tends to leak alongside keys, read How to share a bug report screenshot safely.