View detailed EXIF data and technical photo information securely in your browser.
When your phone or camera saves a photo, it writes a block of metadata directly into the image file. This isn't a separate document or a hidden folder — it's embedded in the same file as your pixels. The format is called EXIF (Exchangeable Image File Format), and it's been the standard since the mid-1990s.
A typical smartphone photo contains dozens of metadata fields. Here's what a single snapshot might reveal:
Beyond EXIF, some files carry IPTC data (used by news agencies and stock photography) and XMP metadata (Adobe's extensible format). These can include photographer names, copyright notices, keywords, captions, and editing history.
The combination of device serial number and GPS data is particularly dangerous. A single photo tells someone where you were. Multiple photos over time build a complete map of your movements — where you sleep, where you work, where your children go to school.
Metadata exposure isn't theoretical. It has real, documented consequences that go beyond abstract privacy concerns.
Stalking and harassment. A 2024 study from the Electronic Frontier Foundation found that metadata-assisted stalking cases increased by 340% over the previous five years. Victims who posted photos to dating apps, classified ads, or social media were targeted based on location patterns extracted from image files.
Home invasions. Burglars have used metadata timestamps to determine when homeowners are typically away. A photo taken at 9:15 AM on a Tuesday, combined with device identification, tells an attacker when that person's house might be empty.
Doxxing. Political activists, journalists, and online personalities have had their real-world identities and locations exposed through metadata in photos they thought were anonymous.
Corporate espionage. Employees photographing whiteboards, product prototypes, or office layouts inadvertently embed the company's physical location and internal timestamps into files that get shared externally.
The uncomfortable truth is that platforms strip metadata inconsistently. Facebook and Instagram remove most EXIF data during upload. Twitter (X) strips some fields but not all. Discord, Telegram, and email attachments typically preserve everything. Many forum platforms, cloud storage services, and direct-sharing methods pass metadata through completely untouched.
You cannot rely on the platform to protect you. The only reliable approach is to check and clean your files before sharing them.
People who check their metadata for the first time often discover things they didn't expect.
Screenshots carry metadata too. On most devices, screenshots include the device model, OS version, and exact timestamp. Some Android devices have been documented including location data in screenshots — even when the user disabled location services for the camera app, because the screenshot function pulls GPS from a different system service.
Edited photos retain original data. Cropping a photo in most apps doesn't remove the original GPS coordinates. Rotating it doesn't erase the timestamp. Even heavy filters and color adjustments often leave the original EXIF block intact. Some editing software actually adds metadata — Photoshop embeds a full editing history, including document IDs and save timestamps.
File names leak information. While not technically metadata inside the file, many cameras and phones generate sequential filenames (IMG_2024_001, IMG_2024_002) that reveal how many photos you've taken and when the sequence started. Some cloud services also embed the original file path.
Thumbnail images persist. JPEG files often contain a small embedded thumbnail that's generated when the photo is first saved. If you crop or edit the main image, the original uncropped thumbnail might still be hiding inside the file. This has been exploited to recover faces and locations that the user thought they had removed.
"Private" photos aren't private. If you send a photo through an app that preserves metadata — most messaging apps with file-sharing features, email attachments, AirDrop — the recipient can read every metadata field, including GPS coordinates of your home.
Not every photo requires a full metadata audit. Context determines risk. Here's a practical framework:
Always check before:
Usually safe without checking:
Depends on context:
The cost of checking is about 30 seconds per image. The cost of not checking can be a comprehensive privacy exposure that's difficult to undo once the data is public.
Discovering that your photo contains sensitive metadata is only useful if you act on it. Your options depend on what you found and what you need to do with the image.
If you found GPS coordinates you don't want to share: The most reliable solution is to strip all metadata from the image before uploading it. This removes the EXIF, IPTC, and XMP blocks entirely, leaving you with a clean image file. The visual quality of the photo is completely unaffected — metadata and pixel data are stored in separate sections of the file.
If you found metadata you want to keep (like copyright info) but need to remove location data: Some metadata editors allow selective removal. You can delete GPS coordinates while preserving photographer credits or camera settings. However, this requires more careful handling than a full strip.
If you found a device serial number: This is often the most overlooked privacy risk. A serial number alone doesn't identify you, but combined with any other information — a forum username, a product listing, a social media post — it creates a persistent identifier that links all your photos together across platforms and time. Removing it is straightforward if you strip the full metadata block.
If you discovered the embedded thumbnail contains the original uncropped image: Stripping and re-saving the JPEG will regenerate the thumbnail to match the current image. Alternatively, converting to PNG (which doesn't use embedded thumbnails) eliminates the problem entirely.
For most people in most situations, the simplest correct action is: check, then strip, then share. The viewer tells you what's there. The removal tool ensures it stays private.