Guide
One sentence carries this page: on a computer you do not own, the risk moves off the picture and onto the disk.
The covering is unchanged. What changes is that every file involved is being created on hardware you will walk away from, in an account that is not yours, with a cleanup step that nobody but you will ever do.
You acquire a second audience you never chose
When you redact on your own machine, there is one audience that matters: the recipient. The whole question is what they can read in the file you send them, and every other page here is some version of that question.
A borrowed machine adds a second audience, independent of the first. It is whoever uses the computer next. They are not sent anything and they are not necessarily looking, which is why this audience is so easy to dismiss — but on the three things that matter, they are in a stronger position than your recipient ever was.
They see the original, not the export. Your careful covering is irrelevant to a file that was never covered. They see every intermediate you made: the first loose pass, the tighter second pass, the version you decided against. And they see the filename, which on a screenshot is frequently a date and time and on a saved document is frequently a description. Your recipient got one curated file. The next person at that desk gets the working set.
The audience is also either unbounded or uncomfortably specific. A public terminal hands the file to nobody in particular and to anybody at all. A friend’s laptop hands it to one named person whose opinion you actually care about, which for a medical letter or a bank statement is arguably the worse outcome of the two.
What actually stays behind
Work down this list before you stand up. Treat each line as a question about existence rather than intent: not “did I mean to leave that” but “is there a copy here.”
- The source file you brought. Wherever it went so that you could open it: Downloads, the desktop, a folder you made and named something forgettable, or the machine’s own pictures folder. This is the highest-consequence item on the list, because it is the uncovered version.
- The export. Client-side processing does not make a saved file virtual. Download writes a real PNG to that machine’s download location, named with a timestamp, and it behaves like any other file from that moment on.
- Every extra export. You can press Download as many times as you like, and each press writes another file. Covering generously, exporting, then tightening and exporting again is a sensible workflow that leaves several files behind, not one.
- The browser’s own record of the download. Browsers generally keep a list of what was downloaded, and that entry is a separate thing from the file: deleting the file does not necessarily remove the line naming it. A filename alone can describe the job perfectly well.
- Recently-used lists. Opening a file through a picker tends to leave it referenced somewhere — in the dialog’s own shortcuts, in a system-level recent-documents list, or both. Exactly where depends on the operating system and its settings, so look rather than assume.
- Thumbnails and previews. Viewing a folder often generates a preview image, and preview caches are not always cleared at the same moment the file is. Worth a thought on a machine where you cannot check.
- The trash. Deleting usually means moving. The trash you moved it into belongs to the account you were signed in as, which on a borrowed machine is frequently not yours to begin with.
- The clipboard. If you pasted the image in, it sat on that machine’s clipboard and may still be sitting there until something replaces it. If that clipboard is synchronised with other devices on the account, it went further than the machine in front of you.
- Whatever you signed into. If the image came out of your email or your cloud storage, the account is usually a bigger exposure than the picture. A session left open outlasts any file cleanup you do.
- Anything the machine’s owner runs. Backup, folder sync, or management software may be present and is not something you can inspect from a web page. On a managed device, assume it may exist and let that inform what you are willing to open there.
One thing is not on the list, and it is the step people worry about most: the editing itself. That part genuinely leaves nothing, for reasons set out further down.
A running order for a machine you do not own
Sequence matters here more than technique, because several of these steps are impossible to do once you have done a later one out of order.
1. Ask whether it has to happen here. The cheapest fix is to not use the borrowed machine for the sensitive part. Redact on your phone or your own laptop and move only the finished export, and the entire category of problem disappears. Use the borrowed machine for the big screen and the keyboard, not for the original.
2. Choose the least sticky way in. Prefer a route that does not require signing into an account on that computer: a memory stick, a cable from your phone, a link that opens without a login. If you must sign in, sign into the one account you need and nothing else, and plan the sign-out as part of the job rather than as an afterthought.
3. Use a private window if you like, but know its scope. It helps with the session and the browsing trail. It does not unsave files. A download made in a private window is an ordinary file on that disk.
4. Keep everything in one folder you created. The failure mode is scattering: original on the desktop, first export in Downloads, second export also in Downloads under a name two digits different. One folder makes the cleanup a single action instead of a memory test.
5. Cover, then check the export rather than the preview. The canvas is displayed fitted to the panel while the pixels are held at full size, so legibility on screen tells you very little. Open the downloaded file and look at it at full size, including any part of a tall capture that never scrolled into view while you worked.
6. Move the export off the machine before you delete anything. Copy it to your stick, or send it to wherever it is going, and confirm it arrived. Delete first and you get to do the whole job again, this time in a hurry.
7. Delete the source and any export that is still there, then empty the trash for the account you were using. Both halves, in that order.
8. Clear the download entry, sign out, close the window. If you pasted the image in, copy something harmless afterwards so the clipboard no longer holds it.
9. Take the physical things with you. The memory stick left in the port, the cable, and the page you printed because the screen was small.
A work laptop is a different problem from a library terminal
Both are computers you do not own, and they fail in opposite directions.
On a daily-use work laptop, the next-user audience mostly evaporates. Nobody else sits down at it, so the file-in-Downloads problem is milder than on a shared terminal. What replaces it is that the device may be administered by somebody else. What is backed up, synchronised or recorded on a managed machine is decided by the organisation’s policy and tooling, and none of it is visible from a browser tab. This page cannot tell you what your employer’s device does; nobody can, from here. The practical rule is to ask or read the policy before you decide that a work laptop is a private place to handle your own medical letter, your bank statement or a family photo. The redaction will work fine. The question is whether the uncovered original should be on that disk at all.
The same logic runs in reverse and is easier to forget. A personal laptop is a machine your employer does not own, so a customer record or an internal screenshot sitting in your own Downloads folder is outside every control your organisation relies on. When work images have to be handled at home, the cleanup discipline in this page applies to your own machine too.
The shared family computer sits between the two and gets the least thought of any of them, usually because it feels like home. It is still a machine with other people’s accounts, other people’s sync settings and a trash that is not yours.
What the editor above does and does not do here
This section is read from this page’s own code, because on a borrowed machine the tool’s boundaries decide which parts of the cleanup are yours.
It stores nothing at all between sessions. There is no localStorage, no sessionStorage and no IndexedDB use anywhere on the page; the only storage-shaped thing in it is an in-memory list of undo snapshots. The working image, those snapshots and the original that Clear restores from live in the open tab and cease to exist when it closes. There is no account, no signup and no saved settings, so the editing step contributes nothing of its own to the list above.
The image is read and processed in the browser. The page reads your file locally, draws it into a canvas, and every operation replaces the pixels inside a region you draw. Download exports the canvas as a PNG named hideshot- plus a timestamp. Nothing is uploaded anywhere — which is exactly why the residue on a borrowed machine is limited to files you can see and delete.
Paste is a genuine route in, and here it is the good one. The page watches for a pasted image and loads it straight into the canvas. On a machine you do not own, that lets you skip writing the original to the disk entirely, which removes the worst item on the cleanup list.
It is region-based, with no whole-image operations. Three modes — Black Box, Blur, Pixelate — and three shapes: rectangle, oval and lasso. There is no crop, no resize and no rotate, so the export comes back at the source file’s exact pixel dimensions. Black Box paints a flat near-black fill; Blur and Pixelate rebuild the region from coarse samples and preserve length and spacing by design.
Everything depends on the tab staying open. Close it before you download and there is nothing saved anywhere to go back to, because there is nowhere for it to have been saved. That is the same property described in why your browser tab must stay open during large batch jobs, and on a borrowed machine it cuts both ways: no residue, but also no recovery.
Small selections are dropped silently. A rectangle drag under about four image pixels, or an oval under six, does nothing and reports nothing. On a rushed session in a public place that is easy to miss.
Common mistakes and misconceptions
“It runs in the browser, so the computer kept nothing.” This conflates processing with storage. The processing stayed in the tab. The file you opened and the file you saved are ordinary files on that disk.
Treating a private window as a clean-up tool. It manages history, cookies and the signed-in session. It does not reach into the filesystem and unsave a download.
Deleting the export and forgetting the original. Backwards. The export is the version that was safe to leave; the original is the one that matters.
Deleting without emptying the trash. A move is not a removal, and the trash in question usually belongs to somebody else’s account.
Cleaning the files and leaving the download list. The entry naming the file outlives the file, and the name is often descriptive enough on its own.
Signing into your mail to fetch the picture and leaving it signed in. You came to redact one image and left an entire account open on a machine you no longer control.
Working in the machine’s own pictures folder. It is the folder most likely to be synced, backed up or opened by the next person out of habit.
Assuming your screen capture went only to the clipboard. Plenty of capture tools also write a file automatically, into a folder you did not choose and may never look at.
Cleaning up one export when you made four. Every press of Download is another file, and the abandoned looser passes are the ones that cover least.
Using the borrowed machine when you did not have to. The most common avoidable version of all of this is a redaction that could have happened on a phone.
Assuming a work laptop is private, or that a personal laptop is fine for work originals. Both machines belong to somebody, and it is not the same somebody in each case.