Blackbar vs macOS Preview and Markup

If you take a screenshot on a Mac and need a hostname gone before it goes in a document, the path of least resistance is the one Apple built: press ⇧⌘4, click the thumbnail, and use the Markup toolbar. It is free, it is instant, and nobody has to approve a purchase order. This page is about where that path is fine and where it stops being fine.

Everything below about Apple's software is taken from Apple's own support documentation, linked inline. Where Apple does not document something, this page says so rather than guessing.

What Apple actually documents

Preview genuinely has a redaction tool. Apple's guide Annotate a PDF in Preview on Mac lists Redaction Selection in the Markup toolbar, described as selecting text to permanently remove it from view, and notes that once you close the document the redaction becomes permanent. That is a real redaction feature and it deserves credit.

It is documented for PDFs. Apple's separate guide Annotate an image in Preview on Mac lists sketch, draw, shapes, text, signatures and styling controls — and no redaction tool. The same is true of the Markup toolbar you get from a screenshot thumbnail or Quick Look: Apple's Mark up files on Mac documents Shapes, Highlight, Sketch, Sign and Text. No redaction.

So when you redact a PNG in Markup, you are not using a redaction feature. You are drawing a filled shape and relying on it to be opaque and to survive the save. That is a different operation, and the distinction is the whole subject of our post Blur and pixelation are not redaction.

The one thing that works in Preview's favour

Apple is explicit that image annotations are not re-editable: "If you annotate an image file, you can't edit, move, or delete the annotations after you save the image", and it recommends converting to PDF first if you want them to stay editable. So the classic "drag the black box aside and read what was under it" failure is not the concern here. What Apple does not document is what happens to the pixel data underneath — and this page will not assert something Apple has not stated. It is simply unspecified, and unspecified is a bad place for a control you are relying on.

The PDF detour, and the trap in it

A reasonable person reads the above and thinks: fine, I will put the screenshot into a PDF and use the real Redaction Selection tool. Watch the save step. Apple documents that to keep annotations editable you use File > Save, File > Export, or File > Export to PDF — and that to flatten annotations so they cannot be edited you use File > Print, then Save as PDF. Export is not the flatten path. Print-to-PDF is.

Side by side

When to use Preview and Markup instead

Honestly, often.

• You are annotating, not redacting. Arrows, circles, a note on a design mock, cropping a screenshot for a Slack message. Preview is right there and it is good.
• You need to redact text in a PDF. Preview has the documented tool for that and Blackbar does not — Blackbar works on images.
• The content is not sensitive. If nothing in the shot would need to be disclosed to a client, the extra rigour buys you nothing.
• You cannot install software. Preview is already approved because it shipped with the machine.
• Signatures, form filling, page reordering, format conversion. Preview does a dozen jobs Blackbar has no opinion about.

Blackbar is a narrow tool. It does one operation and refuses to be a screenshot suite. If your problem is "make this picture clearer", Preview wins on the spot.

Where Blackbar is different

Two things, and they are both about the part of the job that is not drawing.

1 · Finding is harder than covering

Drawing a black box is easy. Noticing the fourth internal IP in a wrapped line of nmap output, at the end of a long day, across forty screenshots, is the part that actually fails. Blackbar OCRs the image and runs 27 detectors over the text — IPv4 with RFC1918 awareness, hostnames and FQDNs, AWS access keys, JWTs, NTLM hashes and secretsdump lines, private key blocks, connection strings, SIDs, emails, IBANs, card numbers — and marks them before you have looked. You still decide; you are just not the search algorithm any more.

2 · Destroying is a specified operation

Blackbar's export rasterises the source, overwrites the redacted regions in the bitmap, encodes a brand-new image, and strips all metadata. A test in the build suite reads exported files back and asserts the original content is gone. You do not have to pick the right menu item — there is one export, and it is the destructive one.

There is also a workflow detail that matters more than it sounds: the same value gets the same label everywhere. 10.10.14.7 becomes [IP-1] in screenshot three and [IP-1] in screenshot nineteen, so a reader can still follow the attack path through a report in which nothing real survives.

Check either one yourself

Do not take this page's word for it, or Apple's. Redact a known string with whichever tool you are considering, export, and interrogate the file rather than the picture:

# Is the string you redacted still in the file?
strings redacted.png | grep -i "dc01.corp.local"

# Did metadata survive the export?
exiftool redacted.png | head -40

# Does the file carry a suspicious tail? (the aCropalypse shape)
ls -l original.png redacted.png

If the string comes back, the redaction was decorative. That test costs thirty seconds and it is the only opinion that counts.

The short version

Preview is a good annotation tool with a documented PDF redaction feature and no documented image redaction feature. Blackbar is a redaction tool that finds the secrets first and specifies what export does to them.

If your screenshots contain client hostnames, credentials or internal addressing, the $19 is cheaper than the conversation that follows one miss. If they do not, use Preview — it is free and it is already open.

Also worth reading: Blackbar vs Snagit and Blackbar vs CleanShot X, or what is still in your screenshot after you crop it.