Redacting screenshots of non-English interfaces

Security work is international even when the tooling is not. Engagements land on consoles set to the client's language, bug bounty targets serve localised pages, and your own machine may not run in English at all. Redaction tools, including this one, are mostly built and tested against English screens. It is worth knowing exactly where that assumption leaks.

The short version

Structure-based secrets are language-blind. API keys, tokens, JWTs, hashes, connection strings, IP and MAC addresses, hostnames, email addresses, IBANs and card numbers look the same on every screen, and detection finds them regardless of the interface language.

Words are not. Names, addresses and labels written in another script are not read at all, and cues like password: only work in English.

Why most secrets survive translation

Automatic detection in Blackbar works in two steps: text recognition turns the image into characters with positions, then 27 detectors look for patterns in those characters. Almost every high-value secret is a format, not a word. AKIAIOSFODNN7EXAMPLE is an AWS access key because of its prefix and length; 10.10.14.7 is an address because of its shape; an IBAN is a country code, two check digits and a validated body.

None of that changes when the menu around it says Zugangsschlüssel or アクセスキー. The key itself is still ASCII, still the same shape, and still found.

Where it breaks

1. Text in other scripts is not read

Recognition is tuned for Latin-script text. Japanese, Korean and Chinese characters are not recognised, so a customer name written 山田太郎, a Korean address or a Chinese company name will not be detected — there is no text for a detector to look at. The same applies to Cyrillic, Greek, Arabic and Hebrew.

This is the case that matters most, because personal data in a local-language interface is usually written in the local script. Treat every name, address and company field on such a screen as a manual box.

2. Accented Latin text is read imperfectly

German, French, Spanish, Portuguese and Dutch screens are mostly readable, but accented characters can be misread or dropped. That rarely affects secrets, which are ASCII, but a hostname or email address with a non-ASCII character in it may be split or missed. Internationalised domain names are the usual culprit.

3. Context cues are English

Some detectors rely on a label rather than a format. The password detector looks for password:, pass= and -p followed by a value. On a German login form the label is Passwort: or Kennwort:, in Spanish Contraseña:, in Japanese パスワード: — and none of those trigger it. A password that has no recognisable format of its own will sail through.

4. Local identifiers have no detector

Formats with an international standard are covered: IBAN, card numbers, E.164 phone numbers with a leading +. National formats are not: German tax IDs, Brazilian CPF and CNPJ numbers, Japanese My Number, Korean resident registration numbers, Mexican CURP, Dutch BSN, and local phone numbers written without the country prefix. If the engagement touches personal data in one of those countries, list its identifiers before you start and box them by hand.

A workflow that holds up

Switch the target UI to English when you are allowed to. Many consoles have a per-user language setting. Evidence captured in English needs fewer manual boxes and reads better in an English report.
Let detection take the structured secrets first. Keys, tokens, addresses and hostnames are the dangerous part and the part detection is good at.
Then sweep the screen for words. Names, addresses, company names, free-text fields and anything in a non-Latin script. Drag a box over each.
Look for local-language password fields and box the value next to them.
Protect what must stay readable. Hold Alt while dragging for a keep box over the part of the screen that proves the finding, so a later detection pass cannot black it out.
Hold Space before exporting. The preview shows the burned result; read it the way the client will, including the parts you do not understand.

Your interface language is a separate question

Blackbar itself now runs in nine languages, and the language you pick changes only the menus, messages and inspector. It does not change what recognition reads or which detectors run. A Japanese interface on an English screenshot finds exactly what an English interface finds, and an English interface on a Japanese screenshot misses exactly what a Japanese one misses.