What your photos reveal: EXIF, GPS, and hidden thumbnails
A photo is more than its pixels. GPS coordinates, camera serial numbers, timestamps, editing history, and embedded thumbnails travel inside image files — here's what's there and how to remove it.
The metadata inside a typical photo
When a phone or camera saves a photo, it embeds a block of EXIF metadata alongside the pixels. None of it is visible when you look at the image, and most of it survives emailing, airdropping, and copying to a USB stick.
- GPS latitude, longitude, and often altitude — precise enough to identify a home address
- Timestamps: when the photo was taken, digitized, and modified
- Device make and model, lens details, and sometimes a camera serial number
- Software fields revealing which apps edited the image
- Owner or artist name fields, if configured on the device
- An embedded preview thumbnail — a small copy of the image inside the file
The risk scenario that makes it concrete
You sell a piece of furniture online and photograph it in your living room. The listing photo carries GPS coordinates of your home. Or you share photos of your child's birthday to a group chat, and each one timestamps and geolocates your routine. None of this requires an attacker with tools — many image viewers show EXIF with a right-click.
The embedded thumbnail deserves special mention because it's a known redaction failure: some editors update the main image but leave the original thumbnail untouched. There have been real cases where a censored image's uncensored original remained visible in its own thumbnail. Any serious metadata-stripping step must remove or rebuild the thumbnail, not just the tags.
What platforms do — and don't — strip
Large social platforms generally re-encode uploads and strip most metadata for public display — but you're trusting each platform's current behaviour, which is undocumented and changes. Messaging apps vary widely: some strip metadata in normal mode but preserve it when sending 'as a file' or 'full quality'. Email attachments, cloud drive shares, and direct file transfers preserve everything.
The safe assumption is simple: if you didn't strip it yourself, it's still there.
How to check and strip metadata locally
Our Image Metadata tool parses EXIF, GPS, XMP, and IPTC data in your browser — the photo never uploads anywhere, which matters when the whole point is that the file is sensitive. Fields are grouped by risk (Location, Device, Time, Identity), with GPS highlighted when present.
Exporting a clean copy re-encodes the image through a fresh canvas: the visible pixels are redrawn as-is, and the metadata containers — including the embedded thumbnail — are simply not part of the new file. The tool then reparses its own output and shows before/after field counts, so 'clean' is a verified result, not an assumption. If the photo's visible content also needs work (faces, documents, screens in the background), do that first with the Redact Image tool, then strip metadata as the final step.