Discord screenshot privacy: what to check before you post
Cover bot tokens, account emails, private channel names, and other readable text before you post a Discord screenshot. Use solid black boxes, then read the PNG with local OCR.
What should you check before posting a Discord screenshot?
A local PNG drawn on 29 October 2026 had no GPS IFD. Tesseract 5.3.4 read fixture-user@example.com from it. After an opaque black rectangle covered that line, the same command did not print the email. A black overlay at alpha 70 still left the token line readable. Alpha 90 did not. This was not a Discord upload.
| Visible area | Common leak | Recommended mitigation |
|---|---|---|
| Server sidebar & channel list | Private moderation channels, unannounced project rooms | Crop tight to the conversation bubble; do not post full-window captures. |
| Discord User Profile modal | Connected accounts (Spotify, Steam, GitHub, PayPal), custom status | Toggle streamer mode or crop out the user banner and mutual servers. |
| Developer Portal & Settings | Bot tokens, client secrets, webhook endpoints | Never screenshot token fields; regenerate immediately if exposed. |
| Operating system taskbar | Workplace VPN status, browser tab titles, calendar popups | Crop above the system tray and below the window titlebar. |
| Customer support receipts | Partial credit card digits, home billing address, order numbers | Black out order numbers and personal email before uploading to public tickets. |
WhatsApp Help: media and documents; WhatsApp Help: longer videos
A screenshot does not have camera EXIF, but it contains literal text. Anyone with optical character recognition or an automated scraper can extract what your eyes glossed over.
Camera photos vs. screenshots: different threat models
In our guide on Discord image privacy, the focus is whether camera metadata like GPS coordinates and hardware serials survive Discord’s upload pipeline. For camera photos, you can inspect the file envelope with a metadata sanitizer.
Screenshots are different. When you capture a window or desktop, the operating system creates a fresh PNG without your physical camera’s GPS. However, screenshots frequently contain high-density operational data:
- Account credentials: Discord webhook URLs, bot tokens, API keys, or browser session headers accidentally visible in developer tools.
- Private identifiers: Your registered account email address, billing invoice IDs, real names, or phone numbers in settings screens.
- Contextual leaks: Hidden channel names, other server icons in your sidebar, direct message previews, and desktop notifications in the corner of your display.
- Game purchase records: Transaction confirmation IDs, gift card codes, or Steam trade URLs pasted into a support channel.
Five high-risk areas in Discord screenshots
| Visible area | Common leak | Recommended mitigation |
|---|---|---|
| Server sidebar & channel list | Private moderation channels, unannounced project rooms | Crop tight to the conversation bubble; do not post full-window captures. |
| Discord User Profile modal | Connected accounts (Spotify, Steam, GitHub, PayPal), custom status | Toggle streamer mode or crop out the user banner and mutual servers. |
| Developer Portal & Settings | Bot tokens, client secrets, webhook endpoints | Never screenshot token fields; regenerate immediately if exposed. |
| Operating system taskbar | Workplace VPN status, browser tab titles, calendar popups | Crop above the system tray and below the window titlebar. |
| Customer support receipts | Partial credit card digits, home billing address, order numbers | Black out order numbers and personal email before uploading to public tickets. |
A PNG measured on 29 October 2026
Pillow 10.2.0 drew a 980 by 460 PNG in DejaVu Sans at 36 px. The lines were “Account email: fixture-user@example.com”, “Bot token: fixture.token.not-real”, and “Channel: #public-fixture”. ExifTool 12.76 listed no GPS keys. The PNG tags were bit depth 8, color type RGB, deflate compression, adaptive filter, 980 by 460, and noninterlaced. The file is 26,254 bytes. SHA-256 is 9e1ab4a040a3d6427ccc99734cec734d23e87d6ec7e7a5b26590d07d760f8535. It was not a capture of a Discord window, and it was not uploaded.
The JPEG beside it is the fixture on the WhatsApp HD note: 24,407 bytes, 1200 by 800, SHA-256 898c1d7d2e423ebe2211551f9d8311f52af9ca997539449b1319f79aa400d326, GPS position 35 deg 0' 0.00" N, 135 deg 0' 0.00" E. The PNG does not carry that GPS IFD. A new PNG is a new file.
Tesseract 5.3.4 was run as tesseract file.png stdout --psm 6. Each row is one file and one run.
| File | Bytes | Email printed | Token printed |
|---|---|---|---|
| Plain PNG | 26,254 | Yes, fixture-user@example.com | Yes, fixture.token.not-real |
| Opaque black rectangle over the email line | 18,040 | No | Yes, fixture.token.not-real |
| Black overlay, alpha 70, over the token line | 26,337 | Yes | Yes, exact token |
| Black overlay, alpha 90, over the token line | 26,377 | Yes | No |
| Gaussian blur, radius 2, on the token line | 37,571 | Yes | Yes, exact token |
| Gaussian blur, radius 4, on the token line | 39,169 | Yes | No. The line came out as “Bot tower fsture toten not ree” |
| Gaussian blur, radius 8, on the token line | 38,838 | Yes | No |
Radius 2 left the exact token in the transcript. Radius 4 did not, and the garbled line was still in the transcript. Alpha 70 left the exact token. Alpha 90 did not. The opaque rectangle removed the email from the transcript and left the token, which sat outside the rectangle. This is Tesseract 5.3.4 with one page-segmentation mode. Another OCR program is another test.
Verifying redaction with in-browser OCR
Before posting a redacted capture into a public Discord server, you can verify whether any text is still machine-readable by running it through Local OCR. Because our tool runs directly in your browser using WebAssembly and local language models, your unposted capture never touches an external server for verification.
If the OCR output extracts your email or token snippet, your blackout wasn't complete. If the output returns only the intended public message, the image is clean to share.
A 4-step checklist before posting to Discord
- Crop first: Cut away taskbars, bookmarks, other server tabs, and notification toasts.
- Opaque blackout: Cover sensitive IDs, emails, and tokens with solid, opaque black boxes—never translucent brushes.
- Check the file size: Discord’s attachment cap is currently 20 MB for non-Nitro users according to the Discord File Attachments FAQ. If your screenshot or video capture is oversized, compress it with the Video Compressor.
- Sanitize container metadata: Use the Metadata Cleaner to strip any remaining color profile comments or editing application stamps.
Questions
What should you check before posting a Discord screenshot?
Cover bot tokens, account emails, private channel names, user IDs, and other text that stays readable. Use solid, opaque black boxes.
How do I check that the blackout worked?
Open the PNG in Local OCR on this site. The check runs in the browser. If the text output still shows an email or a token, cover that area again.
Did a light blur hide the token from Tesseract?
Tesseract 5.3.4 with --psm 6 still printed fixture.token.not-real after a Gaussian blur of radius 2. Radius 4 printed “Bot tower fsture toten not ree” instead of the token. Radius 8 did not print the token line. Alpha 70 still printed the exact token. Alpha 90 did not.
Related Discord resources
Review our Discord platform overview for verified limits and empirical testing details in our Discord image metadata lab. If you are uploading game recordings rather than screenshots, read our walkthrough on compressing Discord video to 20 MB.
Verify text readability before sharing
Extract and inspect text from screenshots locally in your browser before uploading to public Discord channels.
Open Local OCR →