Quick answer
Photos contain hidden metadata with your GPS location, device model, timestamps, and sometimes your name. Anyone who downloads the original file can extract this data in seconds. Strip metadata before sharing photos online, and sanitize filenames that reveal device names or dates.
What metadata hides in your photos
Every photo your phone takes can embed dozens of hidden data fields. The most sensitive:
- GPS coordinates: Latitude and longitude accurate to 3-5 meters on modern phones. Enough to pinpoint your house, workplace, or a specific room in a building.
- Device info: Phone make, model, operating system version, and sometimes a unique serial number. This identifies your exact device.
- Timestamps: The exact date, time, and sometimes timezone when the photo was taken. Combined with GPS, this creates a detailed location history.
- Embedded thumbnails: Small preview images that may contain content from before you cropped the photo. Cropping out a face or address does not remove it from the thumbnail.
- Software tags: Which app edited the file last, revealing your editing workflow or the tools you use.
None of this is visible when you look at the photo. It is stored in EXIF, IPTC, and XMP metadata fields inside the file itself.
How to protect your photos
1. Strip metadata before sharing
Run every photo through a metadata stripper before posting online or sending via email. This removes all EXIF fields, GPS data, device identifiers, and embedded thumbnails. The image looks identical. Only the hidden data is gone.
2. Sanitize filenames
Phones name files with patterns like IMG_20260212_143052.jpg or Tom_iPhone15_photo.HEIC. These reveal when the photo was taken and which device you own. The Filename Sanitizer replaces these with clean, random names.
3. Redact visible information
Metadata stripping handles hidden data, but visible content needs separate treatment. Use the Redact tool to cover license plates, addresses, screen names, or any other identifying text visible in the image itself.
Which platforms strip metadata automatically
Some platforms remove EXIF data when you upload. Others preserve it entirely:
- Instagram, Twitter/X, WhatsApp: Strip EXIF data from uploaded/sent photos.
- Facebook: Strips EXIF from the displayed image but may retain GPS data on their servers.
- Email attachments: Preserve all original metadata. This is the highest-risk sharing method.
- Cloud links (Google Drive, Dropbox, iCloud): Preserve the original file, metadata included.
- Forums and blogs: Varies. Many smaller platforms do not strip anything.
Stripping metadata yourself means you never have to trust a platform's handling. The data is removed before it leaves your device.
Common questions
Do all photos have GPS data?
Only photos taken with location services enabled on the camera app. Screenshots, downloaded images, and photos from cameras without GPS have no coordinates. Drop any photo into the Metadata Stripper to check what it contains.
Does stripping metadata change the image?
The visible image stays identical. For JPEG files, the tool re-encodes at 92% quality, which is visually indistinguishable from the original. PNG and WebP files are re-exported without any quality change.
Should I strip metadata from every photo I share?
If privacy matters to you, yes. The safe default is to strip all metadata before any sharing. It takes seconds and removes data you probably did not know was there. Photos taken at home, at work, or at your children's school carry the most risk.
Clean your photos before sharing
Strip metadata, sanitize filenames, and redact visible info. All processing happens in your browser.
Your files never leave your device