Is Lightshot (screenshot tool) safe?

Medium risk

Lightshot is medium risk. Linking to your prntscr.com account, the extension reads your OS/CPU arch and sends it to api.prntscr.com with your login token, before upload. A marker confirmed 'linux x86-64' left with the token. Once per link, not per screenshot.

Skillbrainsv7.0.1Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Device OS and CPU architecture sent to prntscr.com during account linking

Linking to your prntscr.com account, the extension reads your OS/CPU arch and sends it to api.prntscr.com with your login token, before upload.

A marker confirmed 'linux x86-64' left with the token.

Once per link, not per screenshot.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You take a screenshot with Lightshot and it starts uploading to prntscr.com.

This is the extension's core feature, capturing and hosting a screenshot.

The extension did this

Before the screenshot is uploaded, the extension reads your device's OS and CPU architecture and sends it to prntscr.com's servers along with your login token.

This platform string travels in the same request that links your browser's login token to your prntscr.com account; it is not needed to upload the image itself.

02EvidenceCODE COMPARE
The code that does this

The platform-info read and the account-link request it feeds, as shipped versus in readable form.

What it actually does
Readable form of the platform-info read
function linkAccountIfCookieChanged(authToken, onDone) {
  getStoredAppId(function (appId) {
    chrome.runtime.getPlatformInfo(function (platform) {
      var platformString = platform.os + ' ' + platform.arch; // e.g. 'linux x86-64'
      attachExtension(authToken, appId, platformString, function (result) {
        if (result.success && result.app_token) {
          cacheLoginCookie(authToken);
          storeAppToken(result.app_token, onDone);
        } else {
          onDone && onDone();
        }
      });
    });
  });
}
Readable form of the account-link request
function attachExtension(authToken, appId, platformString, callback) {
  fetch('https://api.prntscr.com/v1.1/', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: JSON.stringify({
      jsonrpc: '2.0',
      id: 1,
      method: 'attach_extension',
      params: {
        auth: authToken,        // your prntscr.com login cookie value
        app_id: appId,          // a per-install UUID
        app_description: platformString  // your OS + CPU architecture
      }
    })
  }).then(r => r.json()).then(r => callback(r.result || null));
}
03EvidenceNETWORK CAPTURE
Captured request
POSThttps://api.prntscr.com/v1.1/
{"jsonrpc":"2.0","id":1,"result":{"success":true,"app_token":"<redacted>"}}
Headers
Acceptapplication/json
Content-Typeapplication/x-www-form-urlencoded
Body
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "attach_extension",
  "params": {
    "auth": "<redacted>",
    "app_id": "{f3d8b21c-9a44-4e07-8b2d-5c910e2a77b1}",
    "app_description": "linux x86-64"
  }
}
04EvidenceFIELD TABLE
What the account-link request sends, beyond what uploading a screenshot requires:
FieldValueWhy it matters
Your prntscr.com login token
value of the __auth cookie on api.prntscr.comIdentifies your account to prntscr.com's servers, needed to link the extension to your account.
Per-install device ID
{f3d8b21c-9a44-4e07-8b2d-5c910e2a77b1}A random ID generated once and stored locally, distinguishing this browser install from others linked to the same account.
OS and CPU architecture
linux x86-64Not needed to upload an image; read via Chrome's platform API and sent with the login token whenever the account link is (re)made.
05EvidencePLAIN NOTE
When this fires

This request runs when the extension links to your prntscr.com account for the first time on a device, or when the cached login cookie no longer matches the current one (e.g. after logging into a different prntscr.com account in your browser). It does not run on every screenshot upload — only on account (re)linking.

Updated 17 September 2026mbniclmhobmnbdlbpiphghaielnnpgdp