How to blur emails, API keys and card numbers in a screen recording

You recorded a great demo, then noticed your work email in the corner, a customer's name in a list, and for two seconds an API key in a settings page. Now you need to blur them before the video goes anywhere, and the only way you know is drawing boxes and keyframing them by hand, frame after frame.

This post covers what actually keeps sensitive data out of a screen recording: preventing it in the first place, finding what slipped through, blurring it properly, and checking the result. The advice works with any tool. After that we show how DemoTake handles each step.

#Why blurring frame by frame goes wrong

Manual blurring fails in predictable ways:

• Things move. You scroll, a panel slides in, the layout reflows. A box drawn at one point in time no longer covers the text a second later.
• Zooms move the picture. If you zoom in during editing, a blur drawn on the zoomed output has to be redrawn for every zoom level.
• You miss the brief ones. An autocomplete dropdown shows three email addresses for half a second. A toast shows a token. You won't spot those on a normal watch-through.
• Light blur isn't redaction. A soft blur over large text can often still be read. A redaction should make the text unreadable, not just fuzzy.
• Other outputs leak. You blurred the MP4, but the thumbnail, the GIF or the screenshots came from the unblurred source.

The safest secret is the one that was never on screen.

#Prevention first: keep secrets off the screen

Most sensitive data in demos is there by accident. Before you record:

• Use a demo account. A dedicated account like demo@yourcompany.com, with its own workspace, beats your personal login every time.
• Seed fake data. Customers named "Ada Example", invoices for "Acme Test Ltd", addresses that don't exist. It looks real and leaks nothing.
• Use test card numbers. Payment providers publish test card numbers for their test mode. Use those, never a real card, even your own.
• Use test or restricted API keys, and revoke any key that appears on screen during recording, even if you plan to blur it.
• Close what you don't need. Mail, chat, other browser tabs, notification banners. Turn on a focus mode.
• Resize the window so the sidebar with your real projects isn't in frame.

Then assume something slipped through anyway, and check.

#Find and blur what slipped through

A good workflow for anything that remains:

1. Blur in the recording's own coordinates, not on the zoomed output, so the blur follows every zoom and crop.
2. Limit each blur to when it's needed: a whole scene for a sidebar, a few seconds for a toast.
3. Use a strong effect. Heavy pixelation plus blur, or a solid box, rather than a light blur.
4. Blur typed secrets for the rest of the scene, not just while typing. A password field can reveal its length, and many fields show the value after you type it.

#How DemoTake does it

#Automatic: Secret Guard

Auto-redact sensitive data is on by default in Settings › Privacy. After you record, DemoTake reads the text on two frames of each scene (one near the start and one about two-thirds through) and adds a blur over anything Secret Guard recognizes:

• email addresses and phone numbers;
• API keys and access tokens in common formats;
• card numbers (only digit strings that pass the card checksum, so most order numbers aren't flagged);
• bank account numbers;
• one-time codes (6 to 8 digits next to words like "code" or "verification").

Because it samples two frames per scene, treat it as a first pass. Text that appears only briefly elsewhere in the scene needs a manual redaction.

#Typed fields are masked automatically

When an agent types into a field, DemoTake knows which element it is. If it's a password or other secure field, or the typed text looks like an email or a secret, the event is marked sensitive: the typed text is dropped from the take, and the field is blurred from the moment it's touched until the end of the scene. The Redactions section of the editor's inspector shows how many typed fields were masked.

You can also ask the command bar (⌘L): "hide the email fields" masks them and remembers the rule for later takes in the project.

#Manual redactions

Press R in the editor, or click Draw Redaction, then drag over the preview. Press Esc to cancel. You draw on the finished frame, but DemoTake maps the box back to the recording itself. It follows zooms and crops, and it appears in every format you export: 16:9, 9:16, square, GIF, screenshots and Reviewer Packs.

A redaction is a fixed rectangle in the recorded window. It doesn't track text that scrolls or moves. If the sensitive text moves, split it into short redactions or re-record that scene with safer data.

Drawn redactions blur the whole scene. For a time range or a different style, use the agent tools: edit_redact takes a normalized region, an optional scene, optional start and end seconds, and a style of blur, pixelate or solid.

{
  "take_id": "take_01j…",
  "scene": "Invite a teammate",
  "region": { "x": 0.62, "y": 0.08, "width": 0.3, "height": 0.05 },
  "start": 2.5,
  "end": 6,
  "style": "pixelate",
  "reason": "Customer email in toast"
}

Omit scene to cover the whole take, and omit start and end to cover the whole scene. More in Redaction.

#What agents and AI see

Secret Guard also protects what leaves the recording. Snapshots returned to your agent have detected secrets blurred before they're saved. Text sent to DemoTake AI or to your own AI provider has secrets replaced with placeholders such as [email], and password fields are never sent. See Privacy and data.

#Secrets in demo specs

If you automate demos with a demotake.json spec, the password never goes in the file. A step references an environment variable instead, and the spec check rejects text that looks like a secret:

{ "action": "type", "secret_env": "DEMO_PASSWORD", "element": { "role": "securetextfield" } }

The demotake CLI forwards the value to DemoTake for that run only. See Demo specs and CI.

#Check the export before you share it

Whatever tool you used, watch the exported file itself, not the editor preview:

• Watch it once at full speed, then scrub slowly through every scene with a form, a list or a settings page.
• Pause on every toast, dropdown and autocomplete.
• Check every format you export. A 9:16 crop can reveal a different part of the screen than 16:9.
• Look at the thumbnail, GIF and screenshots too.
• Rotate any credential that was ever visible unblurred, even for a frame.

DemoTake's proof manifest notes "Sensitive regions blurred." whenever a take has redactions, so reviewers know blurring is intentional.

#A quick checklist

• Demo account, seeded data, test card numbers, test API keys.
• Notifications off, unrelated windows closed.
• Automatic redaction on, then a manual pass for anything it missed.
• Strong blur, pixelate or solid box, in the recording's coordinates.
• Typed secrets masked until the end of the scene.
• Every export watched and every format checked.

To see what Secret Guard finds in your own recordings, download DemoTake, record a take and open the Redactions section in the editor.