What EXIF data is and what it records about you
EXIF stands for Exchangeable Image File Format. It is a metadata standard developed by the Japan Electronics and Information Technology Industries Association and first published in 1995. Every JPEG-capable camera, from a 1990s point-and-shoot to a 2026 flagship smartphone, writes an EXIF block into the file at the moment the shutter fires. The standard has been extended over the years; a modern smartphone JPEG may carry more than 300 distinct EXIF tags.
The most privacy-sensitive tags fall into four clusters. The first is device identification: camera make, camera model, camera serial number, and lens model. These tags link the photograph to a specific piece of hardware and, by extension, to the person who owns it. The second cluster is location data: GPS latitude, GPS longitude, GPS altitude, GPS bearing, and GPS timestamp. A single unstripped JPEG shared publicly exposes the precise coordinates of wherever the shutter fired — which is often a home, an office, a school, or a medical facility. The third cluster is temporal data: the original date-time stamp down to the second, the digitised date-time, and the GPS timestamp, which can differ from the local capture time by the timezone offset. The fourth cluster is software provenance: the operating system version, the camera firmware version, and any editing application that touched the file.
A realistic smartphone JPEG shared without stripping tells a viewer where you live (GPS from photos taken at home), what device you own (make and model tag), what time you sleep (timestamp patterns across a collection), and what editing apps you use (software tag). Aggregated across a collection — even a small one — this constitutes a detailed personal profile derived entirely from the metadata, not the image content.
How the EXIF removal process works in the browser
Server-side EXIF removal tools — those that ask you to upload a file and return a cleaned copy — require the file to traverse a network. The metadata you want to delete travels alongside the pixel data to a third-party server. The server reads the GPS coordinates, the camera serial number, and the capture time before it strips them. You have no way to verify what the server logs or retains before it returns the clean file.
The browser-side approach on this page works differently. The JavaScript running in your tab reads the file from your local disk using the File API, parses the EXIF segment using a client-side parser, and draws the pixel data onto an HTML Canvas element. The Canvas API then exports the image as a new JPEG that contains only the pixel data from the canvas — no EXIF segment, no ICC profile unless you opt to preserve it, no embedded thumbnail. The original file on your disk is not modified. The cleaned file is written directly into your browser downloads folder without touching any server.
You can verify this yourself. Open the browser developer tools (F12 on most browsers) and switch to the Network tab before you drop a file. Watch the network requests as the tool processes and downloads the cleaned file. There are no outbound requests to any domain during the strip operation. The only network activity is the initial page load, which happened before you opened the tool.
EXIF versus IPTC versus XMP: three metadata layers explained
A JPEG processed through a professional photo workflow can carry three metadata standards simultaneously, each written by a different layer of the toolchain. Understanding which standard carries which data helps you decide whether to remove EXIF specifically or strip everything.
EXIF is the camera layer. It is written by the camera firmware at capture time and carries device, sensor, and location data. It cannot be meaningfully modified after capture — though values can be zeroed out, the tag structure persists. Removing EXIF removes the camera-generated provenance trail.
IPTC is the editorial layer. It is written by photo editing and asset management software — Adobe Bridge, Lightroom, Capture One — after capture. It carries captions, photographer credits, copyright statements, keyword tags, and location names (as strings, not coordinates). Professional photographers and publishers rely on IPTC for rights management. If your workflow depends on IPTC rights metadata, removing EXIF only leaves your editorial records intact.
XMP is the application layer. It is written by editing software to record the processing history: every Lightroom adjustment, every Photoshop action, every export setting. It can be embedded inside the JPEG file or stored in a sidecar .xmp file alongside it. Embedded XMP adds file size and may reveal the software version you use and the edits you applied. The full metadata stripper removes all three layers — EXIF, IPTC, and XMP — in a single pass if you want a completely clean file.
Scenarios where removing EXIF data is essential
Sharing photos of children on social media or in group chats: a photo of a child taken at home carries GPS coordinates that reveal the home address. Even if the photo is shared only in a private group, every recipient who downloads the original file can extract that coordinate. Removing EXIF before sharing eliminates that risk entirely.
Selling second-hand equipment photographed at home: product photos taken indoors to sell a laptop or camera on a marketplace carry the GPS coordinate of the location where the photo was taken. Buyers, and anyone who screenshots the listing, can extract that coordinate. Removing EXIF from the listing photos prevents the sale from disclosing your address.
Submitting photos for journalism or legal proceedings: editorial standards in some publications require metadata-free images to prevent chain-of-custody questions about when and where a photo was captured. Legal exhibits sometimes require the opposite — documented provenance — so check the requirements before stripping for a legal submission.
Freelance photographers delivering work to clients: the client receives full EXIF including your camera serial number, which can be cross-referenced against other photos to identify your device. Removing EXIF from client deliverables keeps your device fingerprint out of files you do not control after delivery.
Researchers and activists documenting fieldwork: photos taken at sensitive locations carry GPS coordinates that could compromise the safety of sources or locations if the files are intercepted or subpoenaed. Removing EXIF before transmission is a basic operational security step for anyone working in high-risk environments.
Developers and designers sharing mockup screenshots: screenshots of web applications often carry EXIF written by screen-capture tools, including system software version and sometimes device hostname. Stripping before sharing in issue trackers or client presentations removes that system fingerprint.
GPS coordinates inside EXIF: the highest-risk data
Of all the data an EXIF block can carry, GPS coordinates are the most immediately dangerous for privacy. A latitude and longitude pair is directly actionable: it can be entered into any mapping application and return a satellite view of the location within seconds. Unlike a camera serial number, which requires a secondary lookup to connect to an identity, a GPS coordinate can reveal a physical location to anyone without any additional research.
The GPS cluster in EXIF carries several related tags. GPSLatitude and GPSLongitude store the coordinate in degrees, minutes, and seconds as rational numbers. GPSLatitudeRef and GPSLongitudeRef store the hemisphere (N/S and E/W). GPSAltitude stores elevation above sea level. GPSImgDirection stores the compass bearing of the camera at capture. GPSDateStamp and GPSTimeStamp store the UTC time from the GPS receiver, which is often more precise than the camera clock and reflects the actual moment of capture independent of camera timezone settings.
If you want to remove only the GPS cluster while preserving camera EXIF — useful for photographers who use exposure data in post-processing workflows — use the GPS-only removal tool. It strips the GPS tags selectively and leaves make, model, focal length, aperture, ISO, and timestamp intact. For anything going to a public URL, removing the entire EXIF block is simpler and eliminates all camera-linked data in one step.
After removal: verifying the EXIF block is gone
After downloading the cleaned file, you can confirm the removal worked using the metadata viewer on this site. Drop the downloaded file into the viewer and check the EXIF section. If the removal was complete, the viewer will show either an empty EXIF block or no EXIF section at all. GPS fields, camera model, timestamp, and software tag should all be absent.
On macOS, you can also right-click the file, choose Get Info, and scroll to the More Info section. On Windows, right-click → Properties → Details tab shows EXIF tags directly. Third-party tools like ExifTool (command line) or ExifTool-based GUI applications provide the most complete readout. If any EXIF tags remain, the stripping step did not complete correctly — re-run the file through the tool and check again.
Note that verifying with a different browser or device is useful to rule out cached file state. If you open the downloaded file on a second device and the EXIF is absent, the strip was successful. If EXIF reappears after a cloud sync — iCloud, Google Photos, OneDrive — the cloud service may have merged the original file's metadata into the synced copy. This is a cloud-side behaviour unrelated to the stripping step; if metadata persistence in cloud storage is a concern, store the cleaned file outside the synced folder.