Pixelate a screenshot

• Credentials — API keys, bearer tokens, session cookies, connection strings. These are the classic leak: one terminal screenshot in a bug report has ended many an on-call shift.
• URLs — query strings often carry session IDs, signed tokens, or internal hostnames. Check the address bar before sharing.
• People — emails, usernames, avatars, and customer data in tables. What's routine inside the company is a privacy leak outside it.
• The periphery — notification popups, other browser tabs, dock badges. The embarrassing leak is usually at the edge of the frame, not the center.

For hiding text, pixelation beats blur. Blur keeps averaged information about the characters in place, and under the right conditions lightly-blurred text can be partially reconstructed. Pixelation collapses each block to one flat colour instead, and the bigger the block relative to the type, the less of the original shape survives it — which is why this page starts with a chunky one.

Set the block size to at least the height of the text. Below that, a block still carries the shape of the character underneath it, and shapes are what make text readable — the same reason you can read a sign from far enough away that every letter is a smudge. Above it, a whole character collapses into one square and there is very little left to read. Nothing you do to an image is a cryptographic guarantee, so for a live credential the real fix is to rotate it; for a face, a name, a handle or a spoiler, a chunky pixelation is exactly the right tool and looks like it belongs.