What a Mac screenshot file says about you, and where the real leak is

A screenshot taken on a Mac carries no location and no camera details. The file still says a few things: its name gives the date and time to the second, and inside it sit the pixel size, a Retina marker, the word “Screenshot” and the name of the display it came from. Beside the file, macOS keeps hidden notes on how it was captured. All of that is minor next to what the picture itself shows, which is where most screenshot leaks actually happen.

What is inside the file

We looked at a real PNG screenshot saved by macOS Sequoia (a dragged selection of part of the screen), first with mdls in Terminal and then by reading the PNG’s own data blocks. Here is what it holds.

• The name. Screenshot 2026-04-13 at 8.02.13 AM.png. That is the date and the time to the second, and the name travels with every upload. On recent versions of macOS, the gap before AM or PM is a narrow no-break space rather than an ordinary one. That is why typing the name into Terminal by hand gets you a “No such file” error, and why the odd upload form or script chokes on it. Dragging the file into the Terminal window avoids the problem.
• The pixel size and density. 2196 by 1182 pixels at 144 pixels per inch. 144 is twice the old standard of 72, the mark of a Retina display recording two pixels for every point you saw. A full-screen capture records your display’s exact resolution, which narrows down which Mac or monitor you use.
• The display’s name. The file embeds a color profile named after the screen. For a MacBook’s built-in display that is “Color LCD”. The profile stores the name in a few dozen languages, so a Mac set to British English shows “Colour LCD”. On the Mac we checked, screenshots taken on an external monitor carried that monitor’s brand name instead. The profile also holds a manufacturer and model code.
• A label. The EXIF and XMP blocks in the PNG both contain a user comment that reads simply “Screenshot”.

What we did not find inside the file: no account name, no computer name, no location, and no capture date. The timestamp lives in the name and in the file system’s own dates, not in the PNG.

To see the same list for one of yours, open Terminal, type mdls and a space, drag the screenshot into the window, and press Return. Look for kMDItemProfileName, kMDItemPixelWidth and kMDItemResolutionWidthDPI. Preview’s Inspector (Tools > Show Inspector) shows most of it in a friendlier form. The wider tour of those tools is in how to check a file’s metadata on a Mac.

What macOS keeps beside the file

Some of what mdls reports is not inside the PNG at all. macOS stores it as extended attributes, notes attached to the file by the disk rather than written into it:

• kMDItemIsScreenCapture, set to 1.
• kMDItemScreenCaptureType, which says how you captured it. On our sample it read “selection”; full-screen captures read “display”.
• kMDItemScreenCaptureGlobalRect, the position and size of the box you drew, in screen points.

xattr -l followed by the file shows them raw. xattr -c on a copy clears them all. They are worth knowing about because they behave differently from the inside of the file, depending on how it leaves your Mac.

How each way of sending treats it

• Uploading through a browser, or attaching to an email. The site or the recipient gets the file’s bytes and its name. Extended attributes generally stay behind on your disk.
• AirDrop. The file arrives on another Apple device, and extended attributes may go with it.
• Finder’s Compress command. The zip tucks extended attributes into a __MACOSX folder, which shows up as a stray folder for anyone who unzips it on Windows.
• Copying to the clipboard instead of saving. Add Control to the usual shortcut (Control-Shift-Command-4) and macOS writes no file at all. There is no timestamped name and nothing beside it; the app you paste into makes its own copy, and what that copy carries depends on the app.

The clipboard route is the simplest fix for a screenshot going into a chat or a support ticket. The pixels still go, of course.

The real leak is the pixels

Everything above is small beside what a screenshot shows. And Retina makes it worse: at twice the pixels, a few words in a corner that you never noticed are perfectly readable once someone zooms in. The usual culprits:

• The menu bar. The clock and date, and, if fast user switching is set to show in the menu bar, your full name or account name. The icons on the right say which VPN, password manager or work tools you run.
• A notification. A banner that slid in at the moment of capture, with a sender’s name and the first line of their message.
• The browser. The titles of every other open tab, the bookmarks bar, your profile picture, and the address bar. A share link to a private document, or an address with a session token in it, is not a description of the document; it is the key.
• Finder. The window title and path bar (/Users/yourname/Clients/ and so on), the home folder in the sidebar, network servers named after your employer.
• The desktop and Dock. File names of everything on the desktop, unread counts on Mail and Messages, a wallpaper photo of your house or your children.
• Mail and chat. Addresses in the To and Cc lines, other conversations in the sidebar.

The fix is to capture less and cover what remains: a single window or a selection rather than the whole screen, Do Not Disturb on before you press the keys, and solid opaque boxes or a crop for anything left. How to anonymize a screenshot or photo before posting it walks through that in Preview. Rename the file while you are at it: checkout-error.png says what it is without saying when you were awake.

Where Manatee Clean helps, and where it cannot

The limit first: Manatee cannot blur, black out or crop anything. Its Clean mode removes metadata, and whatever is visible in a screenshot is just as visible in the cleaned copy. The redaction is still a job for Preview.

For a lone Mac screenshot, Clean has little to do either. It strips GPS and camera EXIF, and a screenshot has neither. It does not rename files. Do not assume it removes the display’s color profile; check the copy you plan to send with mdls, as you would any file.

Where it earns its place is the mix screenshots usually travel in:

• Screenshots alongside phone photos. A product listing, a bug report or a blog post often combines both, and the phone photos carry GPS coordinates and the camera model. Clean strips those in the same pass.
• Screenshots inside a PDF. Put screenshots into a PDF, for a bug report or a set of instructions, and the PDF adds its own layer: an author name and the app that made it. Clean strips the document author metadata from a copy.

The routine: open Manatee, choose Clean, and drop the files onto the window or the menu bar icon, or select them in Finder and choose Services > Fix with Manatee. Cleaned copies are written next to the originals, which are never modified, and nothing is uploaded. It is free for 24 hours with every feature, then $9 once.

Questions

Can someone tell which Mac I used from a screenshot?

Roughly. A full-screen capture gives your display resolution and the embedded profile names the display, which together can point to a model of MacBook or a brand of monitor. It does not reveal a serial number, your account name or your computer’s name.

Does a Mac screenshot record where I was?

No. There is no GPS block in a screenshot. The time is in the file name, and anything on screen (a weather widget, a map, a delivery address) can of course give the place away.

Do websites strip screenshot metadata when I upload?

Many image hosts and social sites re-encode uploads, which often discards embedded data, but you cannot see what they keep. Assume the original reached their servers, and deal with the name and the pixels before you upload.

Is converting the screenshot to JPEG a way to clean it?

Not reliably. A converter may copy the profile and comments across or drop them, and you will not know which until you check. Converting also does nothing about what is in the picture.