# Hide a card number in a screenshot

> Payment rules let receipts and screens show at most the first digits (the issuer number) and the last four of a card, so the last four alone are generally fine to leave visible. Here, the screenshot is read on your device, 13- to 19-digit numbers that pass the Luhn checksum are flagged, and what you choose is covered with opaque blocks in a fresh file.

## When a card number ends up in a screenshot

Card details get captured more often than people expect:

- you screenshot an order confirmation or a banking app to prove a payment went through;
- a support chat asks for "a screenshot of the error" and the error page shows the card form;
- you share a photo of a receipt for an expense report or a refund;
- a digital wallet or a virtual card screen shows the full number when you tap "show details";
- you photograph a new card to send to a family member who shares the account.

Any of those images can be forwarded, backed up to a cloud album, or saved on someone else's phone indefinitely. Covering the number before it leaves your hands is much easier than replacing a card later.

## What on a card is sensitive

| Detail | Leave visible? | Why |
|---|---|---|
| Full card number (PAN) | No | With the expiry date and code, it is enough for many online purchases |
| First six to eight digits | Usually unnecessary | They identify the bank and card type, not you, but there is rarely a reason to show them |
| Last four digits | Generally fine | Receipts, statements and apps show them routinely so you can tell cards apart |
| Expiry date | No | Needed for online payments together with the number |
| Security code (CVV, CVC) | No | Printed on the back or shown in apps; never needed in a screenshot |
| Cardholder name | Your choice | Ties the card to you; cover it if the image might travel beyond the recipient |
| Billing address, phone, email | Usually no | Useful for identity checks, and for fraud |

The "last four is fine" convention comes from the card industry's own security standard: PCI DSS requirement 3.4.1 says a card number shown on screens and reports should be masked so that the issuer number and the last four digits are the most anyone sees without a documented business need.

## Steps

1. Load the screenshot or receipt photo: file button, or drag and drop.
2. Use **Find text**: it reads the image on your device and puts a box over each card number it recognizes, plus phone numbers, email addresses, IBANs and long digit runs. The first press downloads the reader from this site; its size appears beside the button.
3. Add boxes by hand for the expiry date, the security code and the name if you want them hidden. To keep the last four digits visible, select the card-number box and drag its corner handle until it covers only the first twelve digits of a 16-digit card.
4. Keep **Cover with** on **Solid block**. Digits under Pixelate or Blur come from a tiny alphabet of ten characters, which makes them easier to guess back.
5. Press **Export**, zoom in on the result, and save or share the new copy.

## How card numbers are recognized

Card numbers have a built-in check digit. The Luhn algorithm, defined in the ISO/IEC 7812 numbering standard, doubles every second digit from the right, adds everything up, and expects a total that ends in zero. Its purpose is to catch typing mistakes, but it is also a handy filter: a random string of digits passes only one time in ten.

Find text uses this in two steps. First, an OCR engine running in your browser turns the image into words and positions. Then a rule looks for groups of 13 to 19 digits, with or without spaces or dashes between the groups, and keeps only those that pass the Luhn check. That catches the usual 16-digit cards and 15-digit American Express numbers, and skips most order numbers, dates and times.

It does not prove a number is a real, active card, and it can miss one. Known weak spots:

- photos of physical cards, where embossed or printed digits are shiny, angled or low-contrast;
- numbers split across two lines, or shown with only some digits;
- card numbers in a stylized font or over a busy background image;
- expiry dates and security codes, which are too short to tell apart from other numbers and are never boxed automatically.

Long digit runs of eight or more are boxed anyway as "numbers", which often catches account and customer numbers on the same screen. Check every box and add what is missing.

## What the saved copy contains

- Opaque black blocks wherever you placed boxes, merged into the image so they cannot be lifted off.
- No hidden data from the original file. EXIF fields, GPS position, XMP and IPTC captions, device details and any leftover data an earlier editor may have left at the end of the file are not carried into the new image.
- The original pixel size, unless the browser runs out of room for a very large photo; then it is scaled down until the longest side is 4,096 pixels, and a message says so.

Screenshots stay in their format (PNG stays PNG, JPEG stays JPEG). HEIC photos open only in Safari and are saved as JPEG.

## Devices and formats

- Runs in up-to-date versions of Chrome, Edge, Firefox and Safari, on desktop and mobile.
- PNG, JPEG and WebP everywhere; HEIC in Safari only, with other browsers asking for a JPG.
- Several screenshots can be loaded at once. Find text runs over each of them, and you can step through the pictures to check the boxes.
- Not for PDFs or video.

## Your screenshot stays with you

A card number is the last thing that should travel to a server you do not know. Here it does not: the screenshot is read into the browser tab, the OCR runs in the tab, and the covered copy is assembled in the tab's memory. Using Find text the first time downloads the recognition engine and its English data from this site, as program files only. When you close the tab, the page keeps nothing.

## A look under the hood

The card rule is a pattern for 13 to 19 digits with optional separators, followed by the Luhn test. The OCR is tesseract.js running as WebAssembly, and 2-D codes are found with the ZXing reader in case a payment QR code is on screen. Exporting draws the image again, boxes included, into a brand-new file. To confirm with your own eyes that nothing is uploaded, follow the [Network panel check](/methodology/).

## FAQ


### Is it safe to show the last four digits of my card?

Generally, yes. Receipts, statements and apps show them so you can tell cards apart, and the card industry's PCI DSS standard treats the issuer digits plus the last four as the most that may be displayed without a business need.

### Does Find text cover the expiry date and CVV?

No. Those are short numbers that look like many other things on a screen. Box them by hand.

### Can it detect card numbers in a photo of the physical card?

Sometimes. Embossed and shiny digits are harder to read than screen text. If no box appears, draw one over the number yourself.

### Why not just blur the card number?

Blur and pixelation keep a smeared version of the digits, and with only ten possible characters, guessing them back is easier than with words. A solid block keeps nothing.

### Is my card number sent anywhere to check it?

No. The Luhn check is simple arithmetic done in your browser. No card network or bank is contacted.

### I already sent a screenshot with my full card number. What now?

Contact your card issuer through the number on the back of the card or in its official app and ask about replacing the card. Covering future screenshots will not undo one already sent.

## Sources

Checked 2026-10-11.

- [PCI Security Standards Council FAQ on PAN masking with 8-digit BINs](https://pcisecuritystandards.org/faq/articles/Frequently_Asked_Question/how-can-an-entity-meet-pci-dss-requirements-for-pan-masking-and-truncation-if-it-has-migrated-to-8-digit-bins): requirement 3.4.1, BIN plus last four as the display maximum.
- [ISO/IEC 7812-1:2017](https://www.iso.org/standard/70484.html): the card numbering standard that specifies the Luhn check digit.

Last updated: 2026-10-17