Tools · Ethical OSINT and privacy self-defense · 10 / 17
Image metadata: reading and removing EXIF before you share photos
See what camera and phone photos reveal through EXIF, XMP, and IPTC fields, including GPS coordinates and device serials, and strip them reliably before publishing.
What photos carry
Most phone and camera images embed metadata: capture time, device make and model, lens, software, sometimes a serial number, and often GPS latitude and longitude. Editing software adds XMP history, and newsrooms add IPTC captions. Many social platforms strip metadata on upload, but email attachments, file shares, websites, and messaging apps that send “original quality” files frequently keep it intact.
Reading metadata with ExifTool
ExifTool reads and writes metadata for nearly every image and document format. Use it on your own files to see exactly what you would be sharing, and group output by family so you can spot location and device fields quickly.
exiftool -G1 -a -s holiday.jpg | less exiftool -gps:all -DateTimeOriginal -Model -SerialNumber holiday.jpg exiftool -r -if '$gpslatitude' -filename -gpsposition ./to-publish/
Lab: audit and clean a folder before publishing
Copy a few of your own phone photos into a working folder. Run the recursive GPS check above to list which files contain coordinates. Strip all metadata into a new folder so originals stay untouched, then re-run the check on the cleaned copies and confirm nothing location-related remains. Finally, open a cleaned file in an image viewer to confirm it still renders correctly.
mkdir -p cleaned && cp to-publish/*.jpg cleaned/ exiftool -all= -overwrite_original cleaned/*.jpg exiftool -gps:all -Model cleaned/*.jpg # expect no output fields
Prevention habits
Turn off location tagging in the camera app if you rarely need it, use the share-sheet option that removes location on iOS and Android, and add a metadata strip step to any website publishing workflow. Remember the image content itself can reveal location through street signs, windows, and reflections, which no metadata tool removes.
- Disable camera location tags by default
- Strip metadata in publishing pipelines
- Check visible content, not only fields
- Keep originals private, publish cleaned copies
Diagram
Photo as captured versus cleaned for publishing
The pixels stay the same; the hidden fields do not.
GPS. 51.5072 N, 0.1276 W
Device. Phone model and serial
Time. Exact capture timestamp
GPS. Removed
Device. Removed
Time. Removed or generalized
Check yourself
1. Which embedded field most directly reveals where a photo was taken?
2. What is the safest stripping workflow?
3. What can still reveal location after metadata is removed?