Blackbar is written by Ivan Spiridonov — xbz0n — a penetration tester, under PXL Security LTD. It is not a side project from a company that has never written a findings document; it comes directly out of the part of the job everyone dreads.
The problem it was written for
Every screenshot in a pentest report is evidence, and nearly every one of them carries something that cannot leave the client's building: internal IPs, hostnames, AD domains, credentials, session tokens, NTLM hashes, employee names and email addresses.
The traditional fix is an evening in Preview or GIMP drawing black boxes by hand across dozens of images. It is slow, and worse, it is unreliable in a specific way: attention degrades. The first screenshot gets checked carefully. The thirty-eighth does not. That is where a hostname survives into a PDF that goes to a client — or to a client's client.
Why it works the way it does
Three decisions follow directly from that, and they are the reason the tool behaves the way it does rather than the way a general image editor would.
Redaction is destructive, always
Export rasterises the source, overwrites the redacted regions in a fresh bitmap, encodes a brand-new image and strips every scrap of metadata. There is no overlay layer, no alpha channel hiding the original, no editing in place. A test in the build reads exported files back and asserts the original content is gone — because covering pixels is not redacting them.
It never touches the network
Client evidence should not transit anyone's servers, including mine. The macOS binary ships with no network client entitlement at all, enforced by a test in CI. The Linux and Windows builds bundle their OCR models and fonts and open no sockets. Licensing is an offline Ed25519 signature check — there is no activation call and no licence server.
Pseudonyms, so the report still reads
The same value becomes the same label across every screenshot in an engagement:
[IP-1], [HOST-1], [AWSKEY-1]. A reader can follow the
attack path across eleven figures without ever learning a real hostname.
Verify rather than trust
Claims about security tooling are worth exactly as much as the checks behind them. Every release ships a SHA-256 manifest and a GPG signature, the macOS build is notarised by Apple, and the Security & Privacy page documents what the app asks your system for and why — including the single keychain item and the macOS screen-recording permission. Run the checks. That page tells you how.
Questions, bugs or a security issue: [email protected]. Vulnerability reports are credited if you want them to be — see Security & Privacy.