Destroy the pixels.
Not just cover them.
Drop a screenshot in. Blackbar finds IP addresses, hostnames, API keys, JWTs, private keys and other secrets, and burns black bars into the bitmap. The exported PNG has the original pixels gone — not hidden under a layer.
Sixteen secrets, gone in one pass
A real terminal — an nmap scan, a secretsdump NTLM hash, an AWS key, a JWT, a password, a Postgres connection string — dropped in, reviewed, and burned. The same value keeps the same label across every screenshot in the report.
![Same terminal redacted with consistent [IP-1], [HASH-1], [AWSKEY-1] labels](/shots/after.png)
Two rules that make it safe
Every leaked-redaction story — acropalypse, the flattened-PDF blunders — comes from the same mistake: covering pixels instead of destroying them. Blackbar refuses to make it.
Redaction is destructive, always
Export rasterizes the source, overwrites the redacted regions in the bitmap, and encodes a brand-new image. No overlay layer. No alpha channel hiding the original. All EXIF, GPS and thumbnails stripped. If you could recover the original, the product failed at its one job — so a test asserts you can't.
Solid fill is the default
Blur and pixelate are reversible — depixelation attacks recover short strings reliably. Blackbar defaults to opaque solid fill and warns, in-line, whenever you reach for a reversible style on something classified as a secret.
Paste → review → export, in about a second
⌘⇧4. Blackbar OCRs it with Apple's Vision engine — tuned for dense terminal text, no language "correction" to mangle 10.0.0.1.Built for people who leak dangerous things
Pentesters, incident responders, security consultants, sysadmins, technical writers.
Secrets
Private keys, JWTs, AWS/GitHub/Stripe/OpenAI/Slack/Google keys, Bearer & Basic auth, NTLM & secretsdump hashes, connection strings, passwords in context.
Identifiers
IPv4/IPv6 (RFC1918-aware), MACs, FQDNs with weight for .corp/.local/.internal, emails, UNC paths, UUIDs, IBANs, Luhn-checked cards.
Consistent pseudonyms
Every unique value maps to a stable label — 10.10.14.7 → [IP-1] — across every screenshot in a report. Readable for the reader, invisible to everyone else.
Smart allowlist
Documentation ranges, loopback, example.com, and version strings that look like IPs are never flagged. Private ranges are — pentesters redact internal topology.
Chrome scrubbing
One-click strips for the menu bar (account, SSID), Dock, browser tabs, and terminal title bars that leak user@host.
Profiles
Pentest Report, Client Demo, Public/Blog — each with its own detector set, RFC1918 policy and default style.
Nothing you redact ever touches a network
Blackbar's app binary ships with no network entitlement — a claim a CI test enforces on every build. Licensing is a signed file you drag in, verified locally with Ed25519. No account, no activation call, no phone-home, no analytics, ever.
Three themes, one keystroke
Dark by default — the context these tools live in. A clean light mode for daylight. And a full Hacker skin, orange-on-black with scanlines, for when you mean it.
One price. Yours to keep.
- Full app, no feature gates
- 14-day free trial, fully functional
- Offline Ed25519 license, use on your own Macs
- Every detector, profile and export format
- Updates for the 1.x line
Questions
Is it really offline?
Yes. The app has no network client entitlement, enforced by a test in CI. It cannot make network calls even if it wanted to.
How does the license work?
After purchase you get a small .blackbarlicense file by email. Drag it onto the Blackbar window to activate. It's an Ed25519-signed file verified on your machine — no server involved.
Can the original pixels be recovered from an export?
No. Export re-encodes a fresh bitmap with the redacted regions overwritten, and strips all metadata. A test reads exported files back and asserts the original content is gone.
What macOS versions?
macOS 14 (Sonoma) and later, Apple silicon and Intel.
Refunds?
The 14-day trial is fully functional so you can decide before paying. If something's wrong after purchase, email support and we'll make it right.