End-to-End Encrypted Screenshots, Explained: What They Protect and What They Don't

Quick answer: an end-to-end encrypted screenshot is encrypted on your device before it's uploaded, with a key the service never receives. Only the people you give the key to can decrypt it, so the company hosting it, its storage provider and anyone who breaks into its servers see only scrambled data. That's stronger than the "encrypted in transit and at rest" most tools offer, where the service holds the keys. It doesn't hide who shared with whom, and it can't stop someone who can see the image from capturing it again. Screshot shares screenshots this way from Chrome.

"Encrypted" appears on almost every product page, and it can mean very different things. For screenshots, which often show customer records, credentials and internal dashboards, the difference matters. This guide explains the three kinds of encryption you'll see, what end-to-end encryption really protects, and the questions to ask before trusting a tool with a sensitive image.

Three kinds of encryption, and who can read your screenshot

• Encryption in transit (TLS, the padlock in your browser) protects the screenshot while it travels between your device and the service. Once it arrives, the service has the readable image.
• Encryption at rest protects the stored file on the service's disks. The service holds the keys, so its systems, its staff with the right access, and anyone who compromises those systems can decrypt it.
• End-to-end encryption encrypts the screenshot on your device, before upload, with a key that only you and the people you choose ever have. The service stores and serves a file it can't open.

Most cloud screenshot tools, file drives and chat apps use the first two. They're good protections against outsiders on the network and stolen disks. Only end-to-end encryption also protects you from the service itself.

How an end-to-end encrypted screenshot works

1. A new key for each screenshot. Your browser generates a random key, typically for AES-256, the same algorithm behind most modern encryption, available in every browser through the Web Crypto API.

2. Encrypt, then upload. The image is encrypted with that key on your computer. Only the encrypted file leaves it.

3. Deliver the key only to the right people. There are two common ways:

• Wrapped for each person. Each recipient has their own key pair. The screenshot's key is encrypted ("wrapped") with each recipient's public key, so only their private key, which never leaves their devices unencrypted, can unwrap it.
• Inside the link. The key is placed after the # in the link. That part of a URL, the fragment, is handled by the browser and isn't sent to the server when the page is requested. Anyone with the full link can open the screenshot; the server still can't.

4. Decrypt in the recipient's browser. The recipient downloads the encrypted file and decrypts it locally with the key they received.

With Screshot, these are the sharing modes: Only me, Invited people and Workspace wrap the key for each person, and Anyone with the link puts it in the link. Switching between them changes who has the key, not the encrypted file, so nothing is uploaded again.

What end-to-end encryption protects

• The image itself, on the server. A database leak, a misconfigured storage bucket or a curious insider exposes only encrypted data.
• The image from the service. The company can't scan it, train models on it, or hand over a readable copy, because it doesn't have the key.
• Comments and notes, if they're encrypted the same way. In Screshot, comments on a shared screenshot are encrypted with a key derived from the screenshot's own key, so only people who can open the image can read the discussion.

What it doesn't protect

• Metadata. The service still knows who shared a screenshot, when, how large it is, and who it was shared with. It needs that to work.
• The recipient's screen. Once someone can see the image, they can take their own screenshot or photo of it. Encryption decides who can open a screenshot, not what they do afterwards.
• What you forgot to hide. Encryption protects the whole image, including the customer email you meant to blur. Blur first; see how to blur sensitive info in a screenshot.
• A leaked "anyone with the link" link. If the key is in the link, the link is the key. Paste it only where everyone who sees it may open the screenshot.
• A compromised device. If your computer runs malware, it can see what you see before anything is encrypted.

Questions to ask before trusting an "encrypted" screenshot tool

• Where is the screenshot encrypted? On your device, or after it reaches the service?
• Who holds the key? If the answer includes the company, it's not end to end.
• Can the service show you the image? If support can "look at your screenshot to help", they have the key.
• How do recipients get the key? Wrapped per person, in the link, or sent separately?
• What happens when you remove someone? Do they lose access to the screenshot and its key?
• Is the code that encrypts open to inspection? In a browser extension or web app, the encryption code ships to your device and can be reviewed.
• What metadata is kept, and for how long?

Checklist for sharing a sensitive screenshot

• Blurred and cropped before sharing
• Encrypted on your device, with a key the service never receives
• Shared with named people, not a link that works for anyone, when it shows customer data
• Access removed or the screenshot deleted when it's no longer needed

FAQ

Is "encrypted at rest" the same as end-to-end encrypted?

No. Encrypted at rest means the stored file is encrypted with keys the service manages, so the service can decrypt it. End to end means only the sender and the chosen recipients have the key.

Can the company behind an end-to-end encrypted tool see my screenshots?

Not the image or its content. It can see metadata such as who shared, when, and with whom.

If the key is in the link, isn't that the same as a public link?

It's private from the server, not from people. The server never receives the part after the #, but anyone you give the full link to can open it. For sensitive screenshots, share with named people instead.

Does end-to-end encryption slow sharing down?

Barely. Encrypting a screenshot in the browser takes a fraction of a second; uploading takes longer than encrypting.

What happens if I lose my key?

With end-to-end encryption, the service can't reset it for you. Tools usually let you keep a recovery code or register a passkey on several devices. Store the recovery code somewhere safe.

Sources

• MDN: SubtleCrypto.encrypt() (Web Crypto API)
• MDN: URI fragment
• Screshot security overview: how the encryption works

Written by

Screshot Team

Product & security team

The team that builds Screshot, the private screenshot tool for Chrome. We write about keeping customer data out of screenshots, rolling out tools across a company, and getting work done faster with your screen.