Photo Metadata Remover

A photograph from a phone is two things in one file. One is the picture. The other is a set of notes the camera wrote about the moment it was taken, and nobody looking at the picture can see them.

Those notes have a formal home. The Exif standard, kept by Japan’s camera industry association, puts them in a segment near the start of a JPEG file and lays them out as a miniature TIFF file: a short header, then directories of numbered tags, each entry twelve bytes long. One directory describes the picture. A second holds the settings of the shot. A third is reserved for satellite positioning. Parts of the tag list read like a form: maker, model, date and time with the offset from UTC, body serial number, lens serial number, camera owner name, unique image ID. The Library of Congress describes the format as one for recording technical details associated with digital photography.

The Electronic Frontier Foundation defines metadata as data that describes a piece of information, apart from the information itself, and warns that it can often reveal a great deal. A photo file is a compact demonstration.

Where the notes are kept

Start with position. Exif stores latitude and longitude as three fractions each, for degrees, minutes and seconds, with a letter for the hemisphere. Altitude is one more fraction with a flag for below sea level. There are also fields for the satellite clock, the direction the lens pointed, and the speed of travel.

Then there is the picture inside the picture. The standard sets aside a second directory for a thumbnail, which can be a small JPEG of its own, and recommends that cameras record one. The whole Exif segment cannot exceed 64 KB, so the thumbnail is small, yet it is a complete image. Friedland and Sommer, in a 2010 security paper, point to earlier work showing that editing software may leave the thumbnail of the original behind. Crop a stranger out of the frame, and the miniature can still show them standing there.

A third hiding place is the maker note. The standard defines it as a tag for manufacturers to record any desired information, with the contents left to the manufacturer. A reader that follows the standard can say how many bytes the note occupies. It cannot say what they mean.

Exif is only the first of three systems. Adobe’s XMP stores a block of XML in a segment of its own, and when the block outgrows one segment it spills into several more. A fourth kind of segment, defined for Photoshop, carries records from the news industry’s IPTC model: by-line, city, province or state, country name, copyright notice, caption. The same fact can therefore be written three times in three dialects. A tool that clears one and leaves two has cleared nothing.

Other corners matter too. The JFIF header at the top of many JPEG files may hold a thumbnail of its own. The multi-picture format used by some cameras appends further complete pictures after the end of the first, each built like an Exif file in its own right; one widely used reader describes them simply as a trailer. PNG has three kinds of text chunk, a chunk for the time of last modification, and one for Exif. WebP has chunks for Exif and XMP, announced by flag bits in its header.

How it gets out

The clearest measurement is still the one Friedland and Sommer made. Over four days they collected the photos linked from the for-sale listings of one region’s classified ads: 68,729 images. About 48 percent still had Exif data. Nine hundred and fourteen, about 1.3 percent, carried GPS coordinates.

A small share, until you look at a single case. They photographed a bicycle with a phone, as a seller would, and fed the embedded coordinates to a street-level map. It placed the photo within +/- 1 m. Among real listings with coordinates, a significant number came from sellers who had withheld their address and phone number and chosen the site’s anonymous mail relay. They had been careful about everything they could see.

That is the pattern. The leak is not carelessness with a secret. It is not knowing the secret was written down.

Why saving again is not removing

The instinct is to open the photo in an editor and save a copy. Sometimes that drops the notes, sometimes it does not, and either way it does something else. Common JPEG compression is lossy: the Library of Congress notes that its quality varies with the encoder and the degree of compression applied. Saving again means decoding the picture and compressing it a second time. The result is a different picture, slightly worse, carrying whatever the editor chose to write back in.

Uploading is the other common hope, and it is uneven. The IPTC tested about a dozen services in spring 2019 by uploading a file with known metadata and inspecting what came back. As it reported then, files saved from Twitter had their metadata stripped off; files saved from Facebook had no XMP, kept a few rights fields in Exif and IPTC form, and had two IPTC fields generated by Facebook itself; Dropbox and Google Drive passed the original file through untouched. Those are observations from 2019, about files saved back out of each service. They say nothing certain about today, or about what a service keeps on its own servers.

There is a cleaner way, and it follows from how the files are built. A JPEG is a chain of segments, each announcing its own length, and the compressed picture is just the longest links in the chain. PNG and WebP are chains of chunks on the same plan. Removing metadata can therefore be an act of editing the chain: copy the links that are picture, skip the links that are notes, and never decode anything.

That claim can be checked. Take the sample photo in the tool above. Its position is stored as 48 degrees, 52 minutes and 36 seconds south, 123 degrees, 23 minutes and 36 seconds west. The arithmetic is 48 + 52/60 + 36/3600 = 48.876667, negative for south, so the report shows -48.876667 and -123.393333: open ocean. Remove the metadata and three tests run. The new file is read again and must contain none of the removed segments. The compressed picture data must be identical byte for byte, shown as a matching SHA-256 hash. And both files are decoded and compared: 480 by 640 is 307,200 pixels, of which 0 may differ.

What deserves to stay

Not every note is about you. A camera turned on its side can store the picture just as the sensor saw it and write an orientation value, from 1 to 8, telling viewers which stored edge is the visual top. Delete that along with everything else and the photo lies on its side.

So it is worth keeping, and worth keeping alone. An Exif block with the orientation and nothing else is 36 bytes: 2 for the marker, 2 for the length, 6 for the word Exif and its padding, 8 for the header, 2 for the count, 12 for the one entry and 4 for the end of the list. Small enough to read by eye.

The color profile is the other candidate. The PNG specification says that when a profile is embedded, the image samples conform to the color space it represents, and the WebP specification says that when none is present, standard sRGB should be assumed. Strip the profile from a photo taken in a wider space and nothing is lost from the file’s numbers, but every screen will now read them against the wrong scale. A standard profile says almost nothing about its owner. A custom one, built for a particular screen or printer, can say more, and that is a judgment for whoever is sharing the file.

The limits are plain. Removing metadata does nothing about the picture itself: a house number, a reflection in a window, a skyline. It cannot reach copies that were sent last week. If only the location is removed, a maker note nobody can decode remains. And formats built on a different plan, such as HEIC, AVIF, TIFF and camera raw files, need their own careful rewriting; a tool that cannot do that losslessly should refuse instead of quietly re-compressing.

A screenshot is the blunt alternative people reach for. It does produce a new file, at the cost of resolution and of anything outside the screen. Whether that file is clean is a question to check, not to assume.

Which may be the useful habit in all of this. A photo’s notes are not hidden, only unshown. Look at them once, and the two halves of the file stop being one thing.