What is EXIF data?
Open any photo from your phone in a text editor and you will see mostly noise — compressed pixel data that means nothing to a human. But scattered near the beginning of the file there are readable fragments: a phone model, a date, sometimes a string of numbers that turns out to be a set of coordinates. That readable portion is EXIF.
EXIF stands for Exchangeable Image File Format. It was standardised in the 1990s by a Japanese industry body so that cameras could record their own settings inside the image file. The intention was practical and entirely benign: a photographer reviewing a shoot wants to know which lens, which shutter speed, which ISO. The format simply reserved a space at the front of the JPEG for that information.
What changed was the camera. Once the camera became a networked device with a GPS receiver and a permanent internet connection, the same convenient little record started holding things nobody thought about in 1995.
What is actually stored
The exact set depends on the device, but a photo from a current smartphone typically carries:
- GPS coordinates — latitude and longitude, and often altitude, recorded at the moment of capture. Accuracy outdoors is usually within a handful of metres.
- Timestamps — when the photo was taken, when it was digitised, and when the file was last modified. Newer devices include the timezone offset, which by itself narrows down a region.
- Camera make, model and firmware version.
- Serial numbers — many mirrorless and DSLR bodies record the body serial, and sometimes the lens serial, in every single file.
- Exposure settings — aperture, shutter speed, ISO, focal length, flash state, white balance.
- Orientation, which tells the viewer how to rotate the image.
- Software — the editing application, and occasionally the account or machine name it was registered to.
- Artist and copyright fields, if the owner ever configured them.
- An embedded thumbnail — a small, separate copy of the image.
Alongside EXIF, most edited files carry additional blocks. XMP is Adobe's format for editing history and rights information. IPTC is an older standard from the news industry, used for captions and credits. A file that has passed through several applications can end up with all three, each holding a slightly different version of the story.
The embedded thumbnail problem
The thumbnail deserves separate attention because it has caused genuine, documented harm. It is a miniature copy of the picture stored inside the metadata block, and critically, it is not always regenerated when the main image is edited.
The consequence is straightforward once you see it. Someone crops a photo to remove a person at the edge of the frame, or blurs a face, or paints over a document on a desk. They export the file. The main image reflects the edit. The thumbnail, in some editing workflows, does not — it still holds the frame as it was before. Anyone who extracts the thumbnail sees the original.
Modern software handles this correctly far more often than it used to, and the failure mode is now rare rather than routine. But "rare" is a poor guarantee when the cost of failure is high, and the reliable fix — removing the metadata entirely — takes seconds.
How EXIF gets read
There is no barrier to reading it. It is not encrypted, obscured or protected in any way. Right-clicking a file and opening Properties on Windows, or Get Info on macOS, shows a portion of it. Photo management applications display it in a details panel. On the command line, the standard tool is exiftool, which dumps every field including ones the operating system hides. Browsers can read it too, which is exactly how the tool on this site works — the parsing happens in JavaScript on your own machine.
The practical implication is that anyone who receives your file can see everything in it, with no special skill or software. There is no scenario in which the metadata is present but somehow unreadable by the recipient.
When it actually matters
It is worth being calibrated about this rather than alarmed. Most photos most people share are unremarkable, and the metadata attached to them causes no harm whatsoever. Sending a picture of dinner to a friend who already knows where you live leaks nothing.
The situations that genuinely warrant attention share a common shape: the recipient does not already know something the file reveals.
- Selling items online. A marketplace listing photographed at home, sent to a stranger, with coordinates attached. This is the single most common real-world case and the one people are most surprised by.
- Any pseudonymous account. Photos posted under a handle, taken on the same camera body as photos posted under your real name, are linkable through the serial number alone.
- Documenting something sensitive. Photographs shared with a journalist, a lawyer, a regulator or a support organisation, where the location or timing of the photo would identify the person who took it.
- Photos of children. Images shared in group chats or on public profiles that carry the coordinates of a home or a school.
- Photographs sent during a dispute. Evidence sent to an insurer, a landlord or an opposing party, revealing more than intended about where you were and when.
The recurring pattern is not one catastrophic photo. It is accumulation. A dozen images shared across a year, each with coordinates and a timestamp, describe a routine — home, workplace, gym, the school gate at half past three. Reconstructing that pattern is a standard technique in open-source investigation, and it does not require sophisticated tooling.
What removing EXIF does not solve
Stripping metadata addresses one specific channel of leakage. It does nothing about several others, and it is worth naming them plainly:
- The visible content of the image. A street sign, a distinctive building, a car registration plate, a reflection in a window, a screen in the background. Visible detail is how most images are actually located, and no metadata tool touches it.
- The filename.
IMG_20240815_121500.jpgcarries a date. Files named after places or people carry more. - Where you sent it. The platform still records the upload, the account and the IP address regardless of what the file contains.
- Screenshots. These usually carry little EXIF, but frequently show notification banners, browser tabs, account names and clocks.
Removing it
Every major operating system offers some form of removal. On Windows, the Properties dialog has a "Remove Properties and Personal Information" option. On macOS, Preview can export without location data, though its coverage is partial. On iOS and Android, the share sheet offers a location toggle that applies to that share only, and it is easy to forget.
The dedicated approach is more thorough. exiftool -all= photo.jpg removes everything and is the reference tool if you are comfortable on a command line. If you are not, a browser-based tool does the same job — but be selective about which one. Most online metadata removers upload your file to a server, which means handing the exact image you were worried about to an operator you know nothing about. This site's tool processes files locally in your browser precisely to avoid that trade; you can confirm it by watching the Network tab in developer tools, or by disconnecting from the internet after the page loads.
One habit is worth more than any tool: keep your originals. Metadata is genuinely useful in your own archive — it is how you find the photos from a particular trip years later. Strip copies, not masters.
Try the photo metadata remover · Do social networks strip EXIF automatically?