I got tired of blurring passwords in Preview, so I built a screenshot tool for pentesters

Every engagement ends the same way for me. I have somewhere between fifty and two hundred screenshots scattered across the Desktop, Downloads and a folder called evidence that I swear I'll organize next time. Half of them have a credential, an internal hostname or a client's employee name sitting in plain sight. Before any of them can go into the report I open each one in Preview, draw a rectangle over the secret, realize a rectangle is not the same as removing the pixels, redo it with the blur tool, crop, save, and try to remember what finding it belonged to.

I did that for six years. A couple of weeks ago I stopped and wrote the tool I actually wanted.

What Redshot does

It lives in the menu bar. You press ⌃⌘S, drag over an area, and the screenshot goes straight into a history and onto the clipboard. Then an editor opens on top of it. Arrows, boxes, text, a highlighter, crop, and the thing I really wanted: pixelate.

Not blur. Pixelate. The region gets downsampled to a handful of blocks and the original pixels are gone from the saved file. Blur filters can sometimes be partially reversed; a mosaic of twelve blocks cannot, there is nothing left to recover.

When you hit Save, the original stays untouched in the history and the edited version is added as a new item. That matters when a screenshot is evidence: you never overwrite what you captured.

The clipboard part came for free once I had the history. Text, links, code, colors, files, all tagged with the app they came from. Press ⌃⌘V, search, pick one, and it pastes into whatever you were using.

And every screenshot goes through Apple's Vision OCR, so three weeks later you can type a hostname you saw in a terminal and get the exact capture where it appeared.

The part that makes it a security tool and not a screenshot app

Redshot never saves anything a password manager marks as concealed. 1Password, Bitwarden and KeePassXC all flag their clipboard writes, and Redshot respects that. You can add any app to an ignore list. And before anything touches disk it runs a few cheap checks: if the text looks like an AWS key, a private key, a JWT, a GitHub or Slack token, or a card number that passes Luhn, it's dropped.

There is no network code in the binary. No account, no sync, no telemetry. Everything is a SQLite file and some PNGs under ~/Library/Application Support/Redshot. Delete the folder and it forgets you existed. The source is on GitHub if you'd rather check than trust.

Install it

The one-liner installs to Applications and skips the Gatekeeper prompt:

bash

curl -fsSL https://raw.githubusercontent.com/marcocarolasec/Redshot/main/Scripts/install.sh | bash

Or download the DMG from marcocarolasec.github.io/Redshot. I don't pay Apple for notarization, so the first time you open it macOS will say it can't verify the app. Go to System Settings → Privacy & Security → Open Anyway. Once.

On first launch a short guide walks you through the two permissions macOS requires: Screen Recording, which every screenshot tool needs, and Accessibility, which is optional and only used to paste directly into the frontmost app.

Needs macOS 14 or later. Apple Silicon and Intel. MIT licensed.

Shortcuts, since you'll ask

⌃⌘S   capture an area (Space switches to window mode, Esc cancels)
⌃⌘W   capture a window
⌃⌘F   capture the full screen
⌃⌘V   open the history
⌃⌘1…9 paste the nth most recent item

In the editor, hold Shift to constrain shapes, Delete removes the selected annotation, ⌘Z undoes, ⌘S saves.

A few decisions, in case you want to argue

I use /usr/sbin/screencapture instead of ScreenCaptureKit. It gives you the system's own crosshair and window picker, needs the same permission, and has worked the same way for fifteen years. The clipboard is polled every half second because macOS has no change notification for the pasteboard; that's what every clipboard manager does, and it costs nothing. The history is a non-activating panel so the app you were in keeps focus and the simulated ⌘V lands where you expect. The whole thing is a plain Swift package with zero dependencies, SQLite through the C API included.

What's next

This is version 0.1 and it does what I needed for my own reports. What I want next, roughly in order: tag captures by engagement and finding, export a set of them with a SHA-256 manifest so you can hand a client a verifiable chain of custody, let the OCR flag credentials and IPs and offer to pixelate them in one click, and export straight to Markdown or docx with consistent file names.

If any of that is useful to you, or if you hit something broken, the repo is at github.com/marcocarolasec/Redshot. Issues and pull requests welcome. A star helps other people find it.

Download it, take one screenshot of your terminal with a password in it, pixelate it, and tell me if it saved you thirty seconds. That's the whole pitch.