What a photo file actually stores
The pixel data is only part of a JPEG. Wrapped around it are several metadata blocks: EXIF (camera and exposure), GPS (coordinates and altitude), XMP (editing history and creator fields), IPTC (caption and copyright), and sometimes a full embedded JPEG thumbnail that predates any crops you made. The table below lists the fields that appear most often and the practical risk each one carries.
| Field | What is stored | Why it matters |
|---|---|---|
| GPS coordinates | Latitude and longitude to ~5-metre accuracy | Identifies home, workplace or any location you photograph regularly |
| Timestamp | Date, time and UTC offset at capture | Reveals when you were somewhere, useful for cross-referencing other records |
| Camera make and model | Manufacturer string and exact model number | Narrows down the population of likely owners; matched against purchase records |
| Body serial number | Unique identifier assigned at the factory | Links photos taken on the same body; used in second-hand equipment fraud disputes |
| Lens identifier | Manufacturer, model and sometimes lens serial number | Further narrows equipment fingerprint, useful in ownership disputes |
| Exposure data | ISO, aperture, shutter speed, focal length, flash state | Low direct risk; confirms camera versus screen-capture origin |
| Software tag | App or OS that last saved the file | Discloses editing tools, device OS version and sometimes app version |
| Author / copyright | Free-text fields set by camera firmware or editing software | Can contain real name or watermarking string written without the photographer's knowledge |
Why the risk is higher than most people expect
Four scenarios come up repeatedly. Listing a house on a property site with original phone photos: the GPS block gives the street address before the listing does. Selling a camera body second-hand: the buyer can pull the serial number from any photo shot on that body and confirm — or dispute — the camera's history. Using a dating or job app where you upload a photo taken at home: the EXIF timestamp and GPS fields are readable by anyone who downloads the image unless the platform strips on ingest. Running a blog or portfolio on your own server: web scrapers routinely harvest EXIF fields at scale, and that data ends up in aggregator databases.
The GPS case is the sharpest. A phone camera records coordinates by default. Most people assume those coordinates stay on the device. They do — until the file leaves it. One share, one upload, one attachment, and the precise location is embedded in a file that anyone can open in a hex editor or a free EXIF viewer.
Which platforms strip metadata automatically
Instagram, Facebook, Twitter and most large consumer platforms strip EXIF on upload — they re-encode the image and discard the metadata block. That protection only applies to the copy the platform serves. The original file on your phone, in your camera roll, in your cloud backup, or in any message you sent before uploading is unchanged.
Self-hosted WordPress without an image-optimisation plugin, direct CDN uploads, Dropbox shared links, personal email attachments, and any direct download from your own server all serve the original file intact. If your workflow includes any of those paths, you need to strip before you send — not after.
Three ways to remove EXIF and metadata
The in-browser tool at the top of this page reads your file locally, re-renders it to a clean canvas, and offers a download with no EXIF block. Nothing is uploaded. That is option one and works on any device with a browser.
Option two is to use your operating system's built-in tools at export time. On macOS, open the image in Preview, choose File → Export, and the exported copy omits location data (though it may keep some camera fields). On Windows 10 and 11, right-click the file, choose Properties → Details, then click "Remove Properties and Personal Information" at the bottom of the panel — you can select all fields or a subset.
Option three is the command line. ExifTool is the standard: exiftool -all= photo.jpg strips every metadata tag in place. ImageMagick does the same with convert -strip photo.jpg clean.jpg. Both are scriptable, so if you process batches of photos regularly — say, before publishing a gallery — a small shell loop handles the whole folder in seconds.
What stripping removes and what it does not
After stripping, the EXIF, GPS, XMP and IPTC blocks are gone. The embedded thumbnail is gone. The software tag is gone. What remains is the pixel data, the colour profile (ICC), and the basic JFIF header. The file is still a valid JPEG and looks identical on screen.
The one structural field worth watching is Orientation. Cameras record which direction the sensor was pointing when the shutter fired, and viewers use that tag to rotate the frame on display. Strip it carelessly and some software will show the raw sensor orientation — typically a sideways photo for anything taken in portrait mode. The tool above handles this by baking the correct rotation into the canvas before stripping, so the output is always right-side up. If you strip with ExifTool or ImageMagick, check the output in a viewer before distributing.
Clearing metadata does not anonymise the visual content itself. A photo taken in your kitchen still shows your kitchen. A selfie still shows your face. A landscape still shows the mountain. Metadata removal is a concrete, auditable step — but it addresses only the machine-readable layer. Read our photo metadata checker to verify the strip worked, or go back to the main tool if you are working with AI-generated images that need both metadata removal and texture humanization.
Screenshots, scans, and edited exports
A screenshot taken on an iPhone or Android device does not carry camera EXIF — there is no lens aperture or GPS fix to record because no camera fired. What it does carry is a color profile (sRGB or Display P3), a resolution tag (DPI or PPI), and sometimes a software tag naming the OS version. That is a much smaller footprint, but it is not zero. If your screenshot captures a document, a conversation, or a map view, the pixel content itself can be more sensitive than any EXIF block — stripping metadata does not help with that, but it does remove the device fingerprint.
Scanned documents converted to JPEG carry a different set of tags. Scanner software typically writes a Make and Model field naming the scanner hardware, a Software tag identifying the scanning application, and an XResolution and YResolution pair. If you run a PDF through a converter first, the output JPEG may also inherit producer and creator fields from the PDF metadata. Neither GPS nor EXIF camera data will be present, but the scanner and software identity can still link a document to a specific device.
Edited photos exported from Photoshop or Lightroom often carry more metadata than the original camera file. Lightroom writes its own XMP namespace — fields like crs:Temperature, crs:Exposure2012, and crs:ToneCurvePV2012 — which encodes your entire edit history as key-value pairs. Photoshop adds a photoshop:History block and may embed a full ICC profile for the working colour space. An "edited" JPEG you share can therefore reveal not just where the photo was taken but which slider you moved and by how much. Run it through the strip tool at the top of this page before sharing if that edit history is not something you want visible.
What social platforms keep after you upload
The major platforms — Instagram, Facebook, X (formerly Twitter), and TikTok — strip EXIF on ingest and re-encode the image before serving it. If you download a copy of a photo you uploaded to Instagram, the returned file will have no GPS block and no original camera EXIF. Instead it will carry platform-injected fields: a software tag naming the CDN pipeline, a color profile conversion artifact, and often a resolution downgrade. The metadata the platform writes is its own, not yours.
That protection is real but narrow. It applies only to the copy the platform serves after processing. The original file you uploaded is gone from their public-facing servers — but the metadata it contained was readable during the upload window and may have been logged. More practically, the protection only covers photos you actually upload to that platform. A file sent as a direct message attachment on most platforms, posted in a forum thread, shared via a cloud drive link, or attached to an email is served as-is. The platform CDN is not involved, so no stripping occurs.
WhatsApp does strip metadata for images sent through its servers, but only when the recipient receives them via the app. If you export a chat backup and share the exported folder, the files in it may retain the original metadata depending on which Android or iOS version created the backup. The practical rule: if you want to be certain a file goes out clean, strip it yourself before it leaves your device. Relying on a platform to do it means accepting that the platform's stripping logic applies everywhere and always — and it does not.
Verifying a file after you strip it
The most direct check is the EXIF viewer at /photo-metadata-viewer: drop the stripped file in and confirm the GPS fields are absent and the Make and Model fields are empty or missing. A clean result will show only a color profile entry and the basic JFIF resolution fields. If GPS Latitude and GPS Longitude still appear, the strip did not complete — re-run the tool or check whether you downloaded the original file instead of the processed one.
Do not use file size as a proxy for strip success. EXIF blocks are typically 10 to 80 KB in a multi-megabyte photo — the size change after stripping is real but small enough to be invisible in a file manager. A photo that shrank by 40 KB after processing might have lost all its metadata, or it might have been re-compressed by the export step and still contain half the EXIF fields. Size alone tells you nothing reliable about what metadata remains. On macOS, right-clicking and choosing Get Info shows a More Info section that will display GPS coordinates if they are present — that is a faster sanity check than file size.
Two edge cases are worth knowing. First, image viewer applications — Apple Photos, Windows Photos, Google Photos — cache thumbnails and preview metadata separately from the file. After you strip a file and reimport it into one of these apps, the app may display old location data from its own cache for a few seconds before refreshing. The file itself is clean; the display lag is the app catching up. Second, if you strip a file and then edit it in a tool like Snapseed or Lightroom Mobile, the export step may write fresh metadata back in — including GPS if the app has location permission. Strip once more after any editing step if the final export is what you plan to share. The command line equivalent for a final audit is exiftool -a -G1 photo.jpg, which lists every tag with its namespace prefix so nothing is hidden.