Check photo metadata what your photo reveals

Before you attach that photo to an e-mail, a listing or a forum post: do you actually know what's written inside the file? Drop it below and find out. The check lists the privacy-sensitive fields it finds (location, device, timestamps, names) and prepares a cleaned copy at the same time; downloading it is optional.

How to read the result

• 📍 GPS location: exact coordinates of where the photo was taken. The single most sensitive field; if it's there, think twice before sharing the original anywhere. More on this at remove GPS from a photo.
• 📷 Camera / phone and 🔢 serial number: identify your device. Serial numbers can link otherwise unrelated photos to the same camera.
• 🕐 Taken on: date and time to the second. Combined with location this reconstructs where you were and when.
• 💻 Software and 👤 name embedded: editing tools and author fields, often written in by cameras or photo apps without you noticing.
• Tag count: the total number of metadata tags the cleaned copy no longer carries. Structural fields a viewer needs (dimensions, orientation, colour profile) are not counted as personal metadata.

Typical results

A fresh phone photo commonly carries 20 to 60 tags including location and device details. A screenshot usually shows nothing personal. An image downloaded from a social network is often already stripped, because large platforms remove most metadata on upload. When your file is already clean, the check says so honestly instead of inventing findings.

Questions about the tools

Where these fields come from in the first place

The report is really a short history of the file. Each group of fields was written by a different step, and knowing which is which tells you a lot:

• Your camera or phone writes the EXIF block at the moment of the shot: model, lens, exposure, the timestamp from the device clock and — if location services were on for the camera — the coordinates. This is the part that's there without anyone choosing to add it.
• Maker notes are the manufacturer's private area inside that block. They're undocumented and vary per brand, which is where things like a shutter count, a lens serial or a body serial number hide.
• Editing software adds XMP and IPTC. Author, copyright, keywords, captions, a rating, the name of the program. If your name shows up in a photo you never signed, it's usually because a photo app filled in an author field once and has been doing it ever since.
• Scanners and phone document modes add their own software tags, and no location — a scan knows the day you scanned it, never the day the picture was taken.

Which is also why some files come back nearly empty, and that's not a failure of the check:

• Screenshots have almost nothing to find — there was no camera involved.
• A photo that came to you through a chat app was usually re-compressed on the way, which throws the metadata away as a side effect. What you're looking at is the platform's copy, not the original.
• Images saved from websites are often already stripped, because most publishing systems remove metadata when they resize an upload.
• A file someone edited and exported can be clean of the camera's data but carry the editor's instead.

Reading the report as a privacy check

Not every field matters equally. In rough order of how much it can actually expose:

1. Coordinates. Five decimal places is street-level, and a photo taken indoors points at a specific building — often a home address. This is the one to act on.
2. The serial number. Underrated and the hardest to think about, because it's invisible in everyday use: the same number appears in every photo that camera has ever taken. Two listings posted under different names, or a public gallery and an anonymous account, can be tied to one device by nothing more than that field.
3. Timestamp plus location together. Individually mundane, together a record of where you were and when. A run of holiday photos posted while you're away says something about your house that has nothing to do with photography.
4. An embedded name. Straightforwardly identifying, and almost always there by accident.
5. Camera model and software. Rarely sensitive on their own, but they narrow a set of "anonymous" photos to one type of setup.

A quick rule that covers most situations: photos going to people who already know you need no thought. Photos going somewhere public or to a stranger — a marketplace listing, a rental ad, a forum, a dating profile, an insurance claim, an image attached to a complaint — are worth checking before they leave. Platforms differ in what they strip and change their minds without telling anyone, so checking the file you hold is the only version of this you control. The cleaned copy prepared alongside the report is the same lossless strip the remover does: the metadata goes, the pixels stay exactly as they were.

What we see people check, and when

Most uploads to this checker aren't "before I post this" — they're "after", when someone has already shared a photo and wants to know, after the fact, what was in it. That changes what the check needs to do: it's not enough to say a field is gone now, people want to know whether it was ever there, because a listing or a message already sent can't be un-shared. That's why the tool always shows what it found before offering to clean it, rather than cleaning silently — a silent clean would answer the wrong question. The other pattern worth knowing: HEIC photos straight off an iPhone tend to carry more than a JPG saved from the same phone, because HEIC keeps a fuller tag set by default and some apps' JPG exports already drop a few fields on the way out. So two photos of the same scene, from the same phone, can show a different tag count purely because of the export format — worth remembering before assuming a "clean" result means the original file was ever clean, or the other way round.

Read on

Curious what all those fields mean and how they get there? Read what your photos reveal. Ready to strip a photo for sharing? The EXIF removal guide walks through it step by step.

By Sam Ridder — I build and run ShinobiTools on my own hardware, on my own. Who I am.