There are two ways a web page can produce a picture of itself. It can ask the browser for a real screen capture through getDisplayMedia, which raises an operating-system picker and can hand back other tabs, other applications, and whatever else happens to be on the screen. Or it can render its own DOM to a canvas and export that, which sees the page and nothing but the page.

DOM-to-image is the narrower of the two, and the narrowness is the whole argument for it. It is also an approximation. Cross-origin images without CORS headers come out blank, iframe contents and a tainted canvas cannot be read at all, and effects such as backdrop-filter are redrawn rather than copied. The result is a reference image, not a forensic record, and it should be described that way to the people relying on it.

Masking is not optional for a widget that ships to sites you do not control. Field values have to be blanked before the pixels are drawn, not after, or the first half-typed password someone leaves on screen becomes an image in a ticket. Marking whole regions is more durable than marking individual fields, because a region keeps covering what somebody adds to it later.

A single frame taken on a button press is a different category of data from continuous replay. Nothing runs between presses, there is no stream, and the reporter sees exactly what is about to be sent before it is attached to anything.

Why it matters

One picture of the broken screen settles more reports than any number of "which browser were you using?" round trips — and you can have it without putting a recorder on every page.