Open a photo in a text editor and, past the wall of binary noise, you will find readable fragments: a camera model, a serial number, sometimes a pair of coordinates. That is image metadata — structured records stored inside the file, sitting next to the pixel data but invisible when you look at the picture. Most people never see it. Most of the time it never matters. But when you share the file, the metadata goes with it, and occasionally it says more than you intended.
This guide explains the three metadata formats you will meet most often — EXIF, IPTC and XMP — what each one actually stores, how geotagged photos have exposed real people, and how to inspect and clean your own images. The tools mentioned below run 100% client-side on this site: files are read by your browser, and nothing is uploaded anywhere.
The short version: pixels plus paperwork
An image file is a container. The bulk of it is compressed pixel data, but the container format — JPEG, PNG, WebP, AVIF — also defines slots for text records: camera settings, captions, copyright lines, editing history. Each record is small, typically a few kilobytes in total, which is why metadata survives unnoticed through years of copying and backups. A metadata cleaner is simply a tool that deletes those records while keeping the pixels intact.
What EXIF, IPTC and XMP each store
The three formats overlap in purpose but come from different eras and different authors. A single file often carries all three at once, sometimes with contradictory values.
EXIF — the camera's notebook
Exchangeable Image File Format data is written automatically by the device the moment the shutter fires. Nobody types it in, which is exactly what makes it sensitive — you cannot forget to add it, and you cannot forget it is there unless you check. A typical EXIF block includes:
- Camera or phone make and model, and often the lens used.
- Exposure settings: ISO, aperture, shutter speed, focal length, flash.
- Timestamps: when the photo was taken, down to the second.
- GPS latitude, longitude and altitude, if location tagging was enabled.
- Device or body serial number on many cameras and phones.
- The software that last touched the file, and a small embedded thumbnail — which can awkwardly show the original, uncropped image even after you crop.
IPTC — the newsroom caption sheet
IPTC fields come from photojournalism. They were designed so a picture editor could see who shot a photo, who owns it, and how to caption it. Unlike EXIF, IPTC data is typed in by a person or a workflow tool such as Lightroom or Photo Mechanic: creator and byline, copyright and usage terms, contact details, captions, keywords, and location names written as plain text. Personal photos rarely contain IPTC data, but stock images, press photos and agency material almost always do.
XMP — the extensible layer
XMP, Adobe's Extensible Metadata Platform, is the modern container that swallowed the older formats. It stores the same kinds of fields as XML, and adds things only editing software produces: full editing histories, document IDs that survive "Save As" and link different versions of a file together, ratings and labels, and — increasingly — AI-related records, from generator names to references to C2PA provenance manifests. When people talk about AI metadata, much of it lives here.
When metadata becomes a privacy problem
The most cited case dates to 2012, when John McAfee was avoiding authorities in Central America. A magazine published a photo of him taken with an iPhone; the EXIF GPS coordinates were still in the file, and readers extracted a precise location in Guatemala within hours. He was detained shortly after. The lesson was not lost on photographers: the picture itself was harmless — the numbers beside it were not.
Militaries learned the same lesson earlier. In 2007, the US Army reported that geotagged photos of newly arrived helicopters, posted online by soldiers, had given away positions in Iraq — one reason geotagging is now treated as an operational-security issue. And the risk is not only military or celebrity. Domestic-abuse charities routinely warn survivors that a single geotagged photo can reveal a new home address to an ex-partner, and researchers have demonstrated tools that map strangers' daily routines from the metadata of their public photos alone.
One reassuring detail: the big social networks — Facebook, Instagram, X — strip most metadata when you upload. But policies change, smaller platforms often keep everything, and files shared by email, cloud links, forums or marketplaces typically travel byte-for-byte, metadata included. Cleaning the file yourself is the only approach that does not depend on someone else's pipeline.
How to inspect what's inside an image
Your operating system shows a slice of it: right-click a file on Windows and open Properties → Details, or open the Inspector in Preview on macOS. It is quick but shallow — GPS is often displayed, XMP usually is not. The gold standard is the command-line tool ExifTool, which prints every field in every format, though the output is dense and technical.
The middle ground is a browser-based scanner. Our Image Privacy Analyzer parses JPEG segments, PNG chunks and WebP blocks directly on your device, groups what it finds by category, and plots GPS coordinates on a map when present. Because it runs locally, you can point it at genuinely sensitive files without hesitation.
How to clean metadata off a file
The most reliable method is re-rendering: decode the image, draw it onto a fresh canvas, and re-encode it. The new file contains pixels and nothing else — every metadata segment is dropped by construction, rather than deleted field by field. That is exactly what the MetadataRemover metadata cleaner does: drop up to 20 images in, read the scan of what was found, clean, and check the post-clean scan that verifies nothing remains. Processing happens in your browser tab; open your network inspector and you will see not a single byte of image data leave the device.
One habit worth forming: keep an untouched master copy in your own archive. Cleaning is one-way, and your future self may want those timestamps and lens settings — just not in the version you publish.