🖼️ EXIF Metadata Viewer & Stripper
100% local processing — your photo never leaves your browser
The Hidden World Inside Your Phone Photos
Every time you snap a photo with your smartphone, you're creating two things at once: the image itself, and a detailed report about how, when, and where it was taken. That second part — the EXIF metadata — lives invisibly inside the file, and most people have no idea it's there until something goes wrong.
EXIF stands for Exchangeable Image File Format, a standard embedded into JPEG files since the mid-1990s. Originally designed to help digital cameras record technical shooting parameters — shutter speed, aperture, ISO — it quietly evolved into something far more revealing as smartphones became the dominant camera. Today a typical iPhone photo can embed your precise GPS coordinates to within a few meters, the exact model of your device, the date and time down to the second, and sometimes even the serial number of the lens.
When Metadata Becomes a Problem
The practical consequences of unstripped EXIF data range from mildly annoying to genuinely dangerous. A domestic abuse survivor who photographs evidence and emails it to a lawyer may inadvertently broadcast their home address. A journalist who photographs a confidential source in a recognizable location can expose that person with a single file attachment. A seller listing furniture on Craigslist reveals their home coordinates the moment they upload an unedited photo from their phone.
These aren't hypothetical edge cases. In 2012, John McAfee — on the run from Belize authorities at the time — was located after Vice Media published a photo of him taken on an iPhone. The image file contained intact GPS coordinates. Reporters hadn't noticed; the metadata spoke for itself.
Closer to everyday life: if you run a small business and post product photos you shot at home, anyone can extract the file metadata and map your home address. If you share photos on a forum while discussing sensitive health topics or legal situations, embedded location data can sometimes be correlated with identifying information. The image is the decoy; the metadata is the tell.
What's Actually Stored, and How Much of It
Modern EXIF data can span dozens of fields. Camera information includes manufacturer, model, firmware version, and sometimes lens serial numbers — sufficient in combination to tie a photo to a specific device. Timestamps are usually stored in three separate fields: when the image was modified, when it was originally taken, and when it was digitized (usually the same as "taken" for smartphones). GPS data, when present, includes latitude, longitude, altitude, direction the camera was facing, and even a timestamp synchronized to GPS satellites that can differ from the device clock.
Beyond location and device info, the shooting parameters — focal length, exposure time, f-number, ISO, white balance, metering mode, flash status — tell a surprisingly detailed story. A forensic examiner can determine whether a photo was taken indoors or outdoors, roughly what time of day it was based on flash usage, and whether post-processing software touched the file afterward (the "Software" tag records this). Adobe Lightroom leaves its fingerprint in EXIF. So does Instagram's export pipeline, in certain cases.
What's not stored: the actual camera roll history, contacts, or any data from other apps. EXIF is limited to the image context. But in that context, it's remarkably thorough.
How Stripping Works Technically
JPEG files are structured as a sequence of segments, each introduced by a two-byte marker. The EXIF block lives in a segment called APP1 (marker FFE1), immediately after the file's opening bytes. A proper EXIF stripper simply reads the raw binary JPEG, identifies the APP1 segment, removes it, and reassembles the remaining segments into a new file. The image data itself — the compressed pixel information — is untouched.
The browser-based approach used here takes a different path that's arguably more reliable for end users: the image is drawn to an HTML5 Canvas element, then exported as a fresh JPEG blob. The Canvas API has no mechanism for propagating EXIF data through the drawing pipeline, so the output is structurally incapable of containing the original metadata. It's a clean-room rewrite of the image data rather than surgical removal from the binary.
The tradeoff is a slight quality reduction — JPEG re-encoding at high quality (95%) introduces a small generation loss. For forensic or archival purposes where you need a perfect pixel-for-pixel copy with only metadata removed, binary segment excision is preferable. For ordinary privacy protection — posting photos online, sending files to strangers, sharing on social media — the canvas approach is completely adequate and has the major advantage of working entirely within the browser without any server involvement.
What Social Platforms Actually Do
Major platforms strip EXIF on upload — this includes Facebook, Instagram, Twitter/X, and WhatsApp. So why does any of this matter for photos shared via those platforms? Several reasons.
First, the stripping happens server-side after upload. The raw file with metadata travels to the platform's infrastructure before any removal occurs. Whether that data is logged, analyzed, or retained depends entirely on the platform's privacy policies, which change. Second, many file-sharing contexts don't strip anything: email attachments, iCloud shared albums, Google Drive, Dropbox, Telegram, Signal (which actually preserves original files by default in some configurations), AirDrop, and any direct download from a website. Third, even when platforms strip EXIF, they typically extract and store the GPS data separately for their own purposes before discarding it from the public-facing file.
The safest approach is stripping before upload, regardless of destination.
Building the Habit Before It's Necessary
Privacy hygiene works best as a pre-emptive habit rather than a reactive fix. Most people only think about EXIF metadata after a specific incident — a stalker problem, a doxxing attempt, a privacy breach they didn't anticipate. But the photographs you've already shared across years of social media and messaging contain a detailed timeline of locations you've been, devices you've owned, and patterns in your daily life.
Going forward, the habit is simple: for any photo you're sharing publicly or with people you don't fully trust, run it through a local EXIF stripper first. The process takes seconds. The alternative — discovering afterward that a file you shared contained your home coordinates — takes considerably longer to deal with.
The tool above handles this entirely in your browser. The file never touches a server, which matters precisely because you're trying to limit who sees the sensitive data embedded in it. There's an obvious irony in uploading privacy-sensitive photos to a cloud service to have their metadata removed; local processing sidesteps that problem entirely.
Understanding what your photos silently communicate is the first step. Deciding what to do about it is straightforward once you can actually see the data staring back at you.