What a photo's metadata gives away, and how to remove it

A digital photo is two things in one file: the picture, and a set of notes about it. The camera or phone writes the notes, and every app that edits the photo can add to them. You rarely see them. Anyone you send the original file to can.

A worked example

We took a published photo from the NASA image library, shot at Kennedy Space Center in April 2025, and read everything the file carries besides the picture. The JPEG is 33.8 MB, and 40.2 KB of that is metadata, in three blocks (1 KB = 1,024 bytes):

None of this is a secret. NASA publishes its photos with credits on purpose. But put a picture you took at home in place of a press photo, and the same fields can describe your camera, when you were there and, often, exactly where.

What each block is

EXIF (Exchangeable image file format) is written by the camera. The Camera and Imaging Products Association maintains the standard. Besides camera settings it defines GPS fields for latitude, longitude, altitude and the direction the camera faced, and it can hold a thumbnail: a small JPEG copy of the image.

XMP (Extensible Metadata Platform) is an XML format created by Adobe and now an ISO standard. Editing software uses it for edit history, ratings, labels and its own details.

IPTC is the news industry's standard for captions, credits, keywords and locations. Agencies and newsrooms fill it in deliberately.

JPEG is not the only format that carries them. PNG has an eXIf chunk and text chunks, WebP has EXIF and XMP chunks in its container, and HEIC photos from phones carry EXIF too. PDFs have their own versions: a document information dictionary with the title, author and software, and an XMP stream.

Three leaks people miss

Location. When the camera app is allowed to use your location, phones write GPS coordinates into each photo. A picture of something you are selling, taken at home, can give away your address.

Serial numbers. Camera bodies and lenses often record their serial numbers. Two photos with the same number came from the same camera, which can link pictures you would rather keep apart.

The thumbnail. The preview inside EXIF is a separate image. Some editors have updated the main picture after a crop and left the old thumbnail behind. In 2004, security researchers crawled the web for this and found published photos whose thumbnails still showed what had been cropped out. Modern editors usually regenerate the thumbnail, but a metadata remover should delete it rather than rely on that.

Who removes it for you

Some services strip metadata when you upload a photo and some do not, and their rules change. In these cases the recipient usually gets the original file, metadata included:

• Email attachments.
• Photos sent "as a file" or "as a document" in a messaging app, an option that exists to keep the original.
• Links to files in cloud storage.
• Uploads to forms, marketplaces and websites that keep the file as it is.

The safe habit is to remove it yourself before you share.

How to check a photo

Open it in a metadata viewer. The image metadata viewer reads JPEG, PNG, WebP, HEIC, AVIF and TIFF in your browser. It lists the camera, dates, location and every other tag it finds, and shows a GPS position as text with a map link that you choose whether to follow.

On Windows you can also right-click a photo, choose Properties and open the Details tab. Most photo apps have an info panel that shows at least the date, camera and location.

How to remove it without harming the photo

There are two ways to get a copy without metadata.

Re-encode it. Take a screenshot, or export a copy from an editor with metadata turned off. This works, but it decodes and compresses the picture again, which costs a little quality each time, and a screenshot changes the size.

Strip it losslessly. A JPEG file is a sequence of segments. Metadata lives in its own segments (APP1 for EXIF and XMP, APP13 for IPTC), separate from the compressed picture. A careful tool copies the picture data byte for byte and leaves the metadata segments out. The photo looks exactly the same because it is the same.

Two pieces are worth keeping:

• Orientation. Phones often store a photo sideways with an EXIF tag that says how to turn it. Remove that tag and the photo appears on its side. A good remover writes back a tiny EXIF block holding only the orientation.
• The colour profile. An ICC profile tells a viewer how to show the colours. It says nothing about you, and removing it can make a wide-gamut photo look dull.

Remove image metadata works this way for JPEG, PNG and WebP. It removes EXIF (with GPS and the thumbnail), XMP, IPTC, comments and text blocks, keeps the orientation and colour profile, and checks the result again before saving. On the NASA photo it removed the 40.2 KB of metadata and copied the 33.8 MB of picture data unchanged. HEIC cannot be rewritten in place, so HEIC photos are converted to JPEG.

For documents, Remove PDF metadata clears the information dictionary and every XMP packet.

A short routine

1. Turn off location for your camera app if you do not use it.
2. Before sharing an original file, open it in a metadata viewer.
3. Remove metadata from anything going to a stranger, a marketplace or the open web.
4. Keep your originals as they are. The metadata helps you sort and search your own library.

Sources

• CIPA DC-008, Exif version 2.32, English translation, Camera and Imaging Products Association. cipa.jp
• XMP documentation, Adobe. developer.adobe.com
• IPTC Photo Metadata Standard. iptc.org
• PNG specification, third edition, W3C: the eXIf and text chunks. w3.org
• WebP container specification, Google. developers.google.com
• Maximillian Dornseif, "EXIF Thumbnail in JPEG images", 17 December 2004, archived copy. web.archive.org
• ISO 32000-1:2008, PDF 1.7, section 14.3 (metadata), Adobe's public copy. PDF32000_2008.pdf
• The sample photo: NASA image KSC-20250404-PH-KLS01_0026. images.nasa.gov