About Screenshot Scrubber

Screenshot Scrubber reads the text in a screenshot on your device, flags anything that looks like personal information or a secret, finds faces, and lets you review every finding before you download a redacted copy or copy clean text. It exists because screenshots leak secrets all the time: a terminal window with an API key, a chat window with a phone number, a whiteboard with a password, a face in the background of a photo of a screen.

How it works

• OCR: the app reads the text in your screenshot with Tesseract, an open-source text-recognition engine that ships with the app. The image is upscaled 2x first for accuracy, and every recognised word keeps its box on the image.
• Pattern checks: the recognised text is checked against patterns for emails, phone numbers, Social Security numbers, card numbers (validated with the Luhn checksum, so random 16-digit numbers are not flagged), AWS keys, GitHub tokens, Slack tokens, Stripe keys, login tokens, URLs with passwords inside, IP addresses, labelled secrets such as api_key = ..., and long high-entropy strings that look generated.
• Face detection: a small on-device face detector finds faces. It only draws boxes; it never identifies anyone, and it does not recognise faces.
• Review: every finding is listed with a checkbox (checked by default) and a plain-English explanation. You can uncheck anything that should stay, and draw a box over anything the scan missed. Download and Copy stay disabled until you have seen the review list and ticked "I have reviewed every finding".
• Output: the scrubbed PNG is built from the image on this page with solid black boxes or blur burned in. The original image is never modified. Copy clean text gives you the recognised text with every accepted finding replaced by [REDACTED].
• Tests: the built-in test mode generates synthetic screenshots with planted secrets (email, phone, card, AWS key, GitHub token, Stripe key, Slack token, SSN, password URL, IP address), plus a clean image and a lookalike image, runs the full pipeline, and publishes the catch rate in the app. The current rate is in the README.

What it catches

• Emails, phone numbers (US and international shapes), and IP addresses.
• US Social Security numbers in XXX-XX-XXXX form, with impossible area numbers rejected.
• Card numbers that pass the Luhn checksum (13 to 19 digits).
• AWS access keys, GitHub tokens, Slack tokens, Stripe live keys, and JSON Web Tokens.
• URLs with a username and password inside them.
• Secrets written next to their label, and long high-entropy strings that look generated.
• Faces, as boxes, so you can decide whether each one should stay.

What it can miss

• Handwriting, tiny text, stylised or distorted fonts, and text at an angle.
• Faces at angles, partly hidden faces, and small faces.
• Secrets split across lines or columns, or partly covered by another window.
• Secrets in an image the OCR misreads by even one character (a 0 read as an O breaks a key pattern).
• Anything in a language other than English: the OCR model is English-only.
• Information that is not text or a face: a visible address on a letter, a reflection, a name on a badge in handwriting.

Reduces risk, never guarantees: always review before sharing. Your review is the real protection. The scan is the assistant that points at the likely problems.

If a secret already leaked

Scrubbing the screenshot is not enough once someone may have seen the secret. Rotate it: revoke the API key or token and create a fresh one, change the password, ask the bank to replace the card. For an AWS key, check the AWS console for unexpected usage. For a GitHub token, check for new keys or webhooks you did not create. Assume a shared secret is copied.

Learn more

These links open other websites in a new tab. Screenshot Scrubber isn't affiliated with any of them and sends them nothing.

Privacy

• Your screenshot never leaves your device. OCR, pattern checks, and face detection all run in your browser. Nothing is recorded, uploaded or shared.
• No accounts, ads, cookies, analytics or trackers. The app loads nothing from other websites: the code and models are served from this site, and a security policy blocks connections anywhere else.
• Stored on your device only: your points, badges, practice days and settings, and whether you have seen the welcome message, in your browser's local storage. Your screenshots are never stored. Clear it any time with the Offline proof → Delete all my data button, or by clearing this site's data in your browser.
• Offline copy: after your first visit, your browser keeps a copy of the app so it works offline. Clearing site data removes it.
• Hosting: like any website, the server that delivers the app's files may keep standard technical logs (such as IP addresses) of those downloads. The app itself sends nothing.
• Reference links go to other websites, which have their own privacy policies.

Disclaimer

• Screenshot Scrubber is a home practice tool, not a teacher, therapist or safety device. Everything runs on your device: no video, audio or images are sent anywhere. Feedback is automatic and can be wrong. For real instruction, learn from privacy and security experts, linked on the Resources page.
• Reduces risk, never guarantees: always review before sharing. The scan can miss secrets, and a redacted image can still leak information through context, reflections, or text the OCR misread.
• Scrubbing a screenshot does not revoke a secret that was already shared. Rotate or revoke anything that may have leaked.
• The app is provided “as is”, without warranty of any kind.

Accessibility

• Everything works with a keyboard. Findings are announced to screen readers, and animations follow your device's “reduce motion” setting.
• The review list is text, so a screen reader can read every finding, its explanation, and whether it will be redacted. The image canvas itself is decorative once findings are listed.

Credits

• OCR: Tesseract.js (Apache 2.0) with the Tesseract engine and the tessdata_fast English model.
• Face detection: MediaPipe tasks-vision FaceDetector (Apache 2.0) with the blaze_face_short_range model.
• Pattern checks: original code in js/detect.js, including the Luhn checksum validation.
• Built with the on-device coach pattern from the Tone Trainer app.

Screenshot Scrubber version 1.0.0