Is Lightshot (screenshot tool) safe?
Lightshot is medium risk. Linking to your prntscr.com account, the extension reads your OS/CPU arch and sends it to api.prntscr.com with your login token, before upload. A marker confirmed 'linux x86-64' left with the token. Once per link, not per screenshot.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Device OS and CPU architecture sent to prntscr.com during account linking
Linking to your prntscr.com account, the extension reads your OS/CPU arch and sends it to api.prntscr.com with your login token, before upload.
A marker confirmed 'linux x86-64' left with the token.
Once per link, not per screenshot.
You take a screenshot with Lightshot and it starts uploading to prntscr.com.
This is the extension's core feature, capturing and hosting a screenshot.
Before the screenshot is uploaded, the extension reads your device's OS and CPU architecture and sends it to prntscr.com's servers along with your login token.
This platform string travels in the same request that links your browser's login token to your prntscr.com account; it is not needed to upload the image itself.
The platform-info read and the account-link request it feeds, as shipped versus in readable form.
function linkAccountIfCookieChanged(authToken, onDone) {
getStoredAppId(function (appId) {
chrome.runtime.getPlatformInfo(function (platform) {
var platformString = platform.os + ' ' + platform.arch; // e.g. 'linux x86-64'
attachExtension(authToken, appId, platformString, function (result) {
if (result.success && result.app_token) {
cacheLoginCookie(authToken);
storeAppToken(result.app_token, onDone);
} else {
onDone && onDone();
}
});
});
});
}function attachExtension(authToken, appId, platformString, callback) {
fetch('https://api.prntscr.com/v1.1/', {
method: 'POST',
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
body: JSON.stringify({
jsonrpc: '2.0',
id: 1,
method: 'attach_extension',
params: {
auth: authToken, // your prntscr.com login cookie value
app_id: appId, // a per-install UUID
app_description: platformString // your OS + CPU architecture
}
})
}).then(r => r.json()).then(r => callback(r.result || null));
}| Accept | application/json |
| Content-Type | application/x-www-form-urlencoded |
{
"jsonrpc": "2.0",
"id": 1,
"method": "attach_extension",
"params": {
"auth": "<redacted>",
"app_id": "{f3d8b21c-9a44-4e07-8b2d-5c910e2a77b1}",
"app_description": "linux x86-64"
}
}| Field | Value | Why it matters | |
|---|---|---|---|
Your prntscr.com login token | value of the __auth cookie on api.prntscr.com | Identifies your account to prntscr.com's servers, needed to link the extension to your account. | |
Per-install device ID | {f3d8b21c-9a44-4e07-8b2d-5c910e2a77b1} | A random ID generated once and stored locally, distinguishing this browser install from others linked to the same account. | |
OS and CPU architecture | linux x86-64 | Not needed to upload an image; read via Chrome's platform API and sent with the login token whenever the account link is (re)made. |
This request runs when the extension links to your prntscr.com account for the first time on a device, or when the cached login cookie no longer matches the current one (e.g. after logging into a different prntscr.com account in your browser). It does not run on every screenshot upload — only on account (re)linking.