**Free online EXIF viewer and metadata remover — GPS, C2PA, AI**

> Free online EXIF viewer and remover: read the location, camera serial, timestamps and any C2PA or AI tag in a photo, then strip all of it without re-encoding.

Source: https://appvau.lt/tools/photo-metadata/ · updated: 2026-09-11

# See the EXIF, GPS, C2PA and AI metadata in a photo, then remove it

Open a photograph and see everything it says about you that you did not type: the coordinates, the camera's serial number, the exact second, the editing history, and whether the file declares that a model made it. Then take all of it out without re-compressing the picture.

DROP · PASTE · CHOOSE

Drop a JPEG, PNG or WebP here

or choose a file. It is opened in this browser tab and never uploaded — this page has no endpoint to upload it to.

## What is actually inside a photograph

A JPEG is not one thing. It is a container with the compressed picture in the middle and a series of labelled blocks around it, and any piece of software that touches the file may add one. This tool reads 7 kinds of block across three container formats, and the first thing worth knowing is how many separate places a name or a location can hide.

*The metadata carriers this tool reads and removes*

| Carrier | Where it lives | What it holds |
| --- | --- | --- |
| EXIF | JPEG APP1, PNG eXIf chunk, WebP EXIF chunk | The camera record: the fields above, in a TIFF structure. |
| XMP | JPEG APP1 (Adobe namespace), PNG iTXt, WebP XMP chunk | An RDF/XML sidecar Adobe software writes. Holds edit history, ratings, captions, the originating document ID, and the IPTC "digital source type" that declares AI generation. |
| IPTC-IIM | JPEG APP13, inside a Photoshop image resource block | The newsroom caption format: byline, credit, source, keywords, city, country. Older than XMP and still written by wire services. |
| ICC profile | JPEG APP2, PNG iCCP, WebP ICCP chunk | The colour profile. Not identifying, and removing it can shift colours on a wide-gamut screen — which is why it has its own switch in the tool rather than being swept up with the rest. |
| C2PA Content Credentials | JPEG APP11 (JUMBF), PNG caBX chunk, WebP C2PA chunk | A cryptographically signed record of where the file came from and what was done to it, including whether a generative model made it. Removing it does not alter the pixels; it removes the provenance claim, and a platform that checks for one will report the file as unverified. |
| MPF (Multi-Picture Format) | JPEG APP2 | An index of additional images stored inside one JPEG — a depth map, a motion photo, or the gain map of an Ultra HDR file. |
| Embedded thumbnail | JPEG IFD1, inside the EXIF block | A small copy of the image, written at capture. It is not updated when you crop or redact the main image, so the thumbnail can still show what you removed. This is a documented, repeatedly-exploited failure. |

The EXIF block alone is a small database. The dictionary behind this page describes 41 fields across 6 categories — location (10), device (7), time (5), author (6), editing history (4), capture settings (9) — and rates each one by what it gives away rather than by how technical it sounds.

## The fields that identify a person

10 of those fields are rated high, meaning that on their own they locate a place, a device or a name. They are worth reading once, because the list is not the one most people expect: the coordinates are obvious, and the serial numbers are not.

- **Latitude hemisphere.**North or south. Useless alone, required to read the latitude.
- **Latitude.**Where the photo was taken, typically within 5-10 metres on a phone with a clear sky.
- **Longitude hemisphere.**East or west.
- **Longitude.**The other half of the coordinate. A home address is one lookup away.
- **Camera serial number.**The individual camera body. This is the field that ties every photo you have ever published to one device — and to the receipt.
- **Lens serial number.**The individual lens.
- **Image unique ID.**A per-image identifier some cameras write, which can link copies of a file across the internet.
- **Camera owner.**A name typed into the camera menu once and then forgotten about for years.
- **Artist.**A name, written by the camera or by editing software from its own settings.
- **Copyright.**Usually a name, sometimes an email address or a studio.

The camera body serial number deserves the attention it rarely gets. It is written into every frame a given camera produces, it survives most editing workflows, and it is the same number on the receipt. Anyone with two photographs can tell whether the same camera took both; anyone with a photograph and a retailer's record can go further. For a photojournalist, an anonymous seller or anybody publishing under a pseudonym, that single field undoes the pseudonym.

The second surprise is the embedded thumbnail. A camera writes a small preview inside the EXIF block at the moment of capture, and a surprising amount of software never updates it. A photograph that was cropped to remove something, or painted over, can still carry a thumbnail showing the original frame. This has produced published, documented failures more than once, and it is why the tool reports the thumbnail separately rather than folding it into a byte count.

## Location is not only the coordinate

When a photo carries GPS data it usually carries more than latitude and longitude. Altitude, accurate to a metre or so, implies a floor in a building. The image direction — a compass bearing — says which way the lens was pointing, which with the coordinate identifies the specific window. The GPS timestamp comes from the satellites in UTC, so unlike the camera clock it cannot be wrong about the time zone. The positioning method says whether the fix came from satellites or from a cell tower.

Put together, a handful of holiday photographs establish a home address, a workplace, a daily route and the hours somebody is out of the house. None of that requires any skill to extract: every one of those fields is plain text inside the file, and every operating system has a built-in viewer for them.

This tool shows the coordinate and offers a map link, and the link is not followed unless you click it. That distinction matters on a page whose whole argument is about what leaves the device: opening a map means telling the map where the photo was taken, and that should be a decision rather than a side effect.

## Content Credentials, AI declarations, and what none of it proves

Two newer kinds of block sit alongside the old ones. C2PA Content Credentials are a cryptographically signed manifest describing where a file came from and what was done to it — attached by some cameras, by Adobe software and by several image generators. The IPTC digital source type is a single XMP field with a controlled vocabulary that says, in a machine-readable way, how the image was made.

*IPTC digital source types, the standard way a file declares its origin*

| Value | What it asserts |
| --- | --- |
| trainedAlgorithmicMedia | Created entirely by a generative model. |
| compositeWithTrainedAlgorithmicMedia | A composite that includes model-generated elements. |
| algorithmicMedia | Created by an algorithm that was not trained on data — a fractal, a render. |
| digitalCapture | A photograph from a camera sensor. |
| composite | A composite of captured images. |
| algorithmicallyEnhanced | A capture that a model has modified. |

The tool reports both, plus any generator name it recognises in the Software or CreatorTool string. What it will not do is tell you that an image is *not* AI-generated. A declaration is a claim the file makes about itself, and claims are removable — this page removes them in one click, which is exactly the point. An image with no declaration has told you nothing.

The same applies to the question people actually arrive with, which is how to remove an AI watermark. If the watermark is metadata, it comes off here. If it is a visible mark drawn into the picture, this is the wrong tool and [the redactor](https://appvau.lt/tools/face-blur/) is a blunt instrument for it. If it is an invisible statistical watermark of the SynthID kind, it is in the pixels, it survives re-encoding and resizing, and nothing that reads metadata — including this — can see it or remove it. Anyone claiming otherwise is selling something.

There is also a case for keeping a manifest. If you are publishing journalism, evidence, or work whose provenance is part of its value, the Content Credential is the thing that lets a reader verify it. Stripping it is the right default for a private photograph and the wrong default for a published one, so the tool tells you what is there and lets you decide rather than deciding for you.

## Why this does not re-encode the picture

The common way to remove metadata is to open the photo in an editor and save it again, or to use a web tool that draws it on a canvas and exports a new file. Both work, and both re-compress the image. A JPEG that has been through an encoder twice has lost detail permanently, for no reason connected to privacy at all.

This tool rebuilds the container instead. It walks the file's structure, drops the blocks that carry metadata, and copies the compressed image data across byte for byte — the JPEG's scan data, the PNG's IDAT chunks, the WebP's VP8 payload. The picture that comes out is bit-identical to the picture that went in. The cleaned file is then parsed again by the same reader, and the receipt says what is left rather than asserting that nothing is.

The other tools on this site do re-encode, because resizing and compressing are operations on pixels. They also drop the metadata as a side effect, which is fine when you wanted a smaller file anyway and wasteful when you only wanted the location gone.

## What removing metadata does not do

It does not make a photograph anonymous. The picture itself is evidence: a recognisable street, a window with a view, a reflection in a kettle, a document on a desk, a name badge, a screen in the background. Reverse image search matches the photograph, not its headers. If the point is that a person or a place should not be identifiable, the metadata is the easy half and [covering what is in the frame](https://appvau.lt/tools/face-blur/) is the rest of it.

It also does not reach the copies. The original is still on the device, probably in a cloud backup, quite possibly in a message you already sent, and certainly on the servers of any platform that received an upload before you thought about this. Stripping before you send is the only part of that chain you control, which is precisely why it is worth doing.

And it does not help with the photographs you never meant to send at all. That is a different problem, and it is the one the app was built for: AES-256-GCM encryption on the device, under a key derived from the 5×5 unlock pattern, converted to a high-entropy seed, with 600,000 PBKDF2-HMAC-SHA256 iterations between an attacker and a guess. The [encryption page](https://appvau.lt/encryption/) lists every parameter, and the [threat model](https://appvau.lt/security/) is honest about what that does and does not defend against.

WHAT IT DOES NOT DO

## The limits, stated here rather than discovered later

- HEIC, the iPhone default, cannot be opened outside Safari because Chrome and Firefox have no decoder for it. Export or share the photo as JPEG first.
- Removing metadata does not remove an invisible watermark. Google SynthID and similar schemes live in the pixels, survive re-encoding, and are not detectable by any metadata reader including this one.
- A file that declares no AI generator is not thereby a photograph. These declarations are trivially removable, which is the whole point of this page.
- Platforms re-encode what you upload and strip most metadata themselves — but not all of them, not consistently, and not before their own servers have read it.

**What is checked:** The cleaned file is parsed again by the same reader, and the result says what is left rather than claiming nothing is.

## Questions people ask about this

1. 01 What does EXIF data actually reveal about me? On a phone photograph, usually the GPS coordinates where the shutter fired to within 5-10 metres, the exact date and time to the second, the phone model, and the time-zone offset. On a system camera it can also include the body and lens serial numbers, which tie every photo you have ever published to one piece of hardware, and a name typed into the camera menu years ago.
2. 02 Does removing metadata change the image quality? No. This tool rebuilds the container and copies the compressed image data across byte for byte, so a JPEG keeps its exact scan data and a PNG keeps its IDAT chunks. The usual way to strip EXIF — open the photo in an editor and save it again — re-compresses the picture and loses detail for no reason.
3. 03 Is my photo uploaded to a server? No. The file is read by JavaScript in this tab and never leaves the device. There is no upload endpoint on this site to send it to, and the page works with the network disconnected after it has loaded.
4. 04 How do I check if an image was generated by AI? You can check what the file declares, which is what this tool reads: the XMP field Iptc4xmpExt:DigitalSourceType, a C2PA Content Credentials manifest, and the Software or CreatorTool string. A match proves the file says a model made it. No match proves nothing at all, because those fields are removable in one click — by this page, among many others.
5. 05 What are Content Credentials, and should I remove them? C2PA Content Credentials are a cryptographically signed record of where a file came from and what was done to it, attached by cameras and editing software. Removing the manifest does not change a single pixel; it removes the claim. If you are publishing journalism or evidence, keep it. If the manifest names you, your software or your workflow and you are publishing anonymously, that is a reason to take it off.
6. 06 Why does the tool keep the orientation tag? Because a phone photograph is stored in landscape with a tag saying which way to turn it, and stripping that tag is how a portrait photo ends up sideways everywhere it is opened. The tool writes a 34-byte EXIF block containing the rotation flag and nothing else. You can switch it off.
7. 07 Does an embedded thumbnail matter? It can matter more than the main image. A camera writes a small preview inside the EXIF block at the moment of capture, and some editors never update it — so a photograph that was cropped or painted over can still carry a thumbnail showing what was removed. This tool reports the thumbnail if there is one and removes it with the rest of the EXIF.
8. 08 Do social networks strip metadata for me? Most strip most of it on publication, which is not the same as never having it. The upload itself carries the original to their servers, where it is retained under their policy rather than yours. Stripping before you upload is the only version of this you control.
9. 09 Can removed metadata be recovered from the file? Not from the file this tool gives you: the bytes are gone, not hidden. It can obviously still exist in the original on your device, in a cloud backup, in the message you already sent, and in any copy a platform made before you thought about it.
10. 10 What formats does it read? JPEG, PNG and WebP, covering EXIF, XMP, IPTC-IIM, ICC, MPF, PNG text chunks and C2PA in all three containers. AVIF is read as an image by the other tools here but its metadata is not parsed yet.

## Other tools on this site

[All 10 tools](https://appvau.lt/tools/)

- [Photo privacy Photo redactor: blur, pixelate, black bars](https://appvau.lt/tools/face-blur/)
- [Image files Image compressor](https://appvau.lt/tools/image-compressor/)
- [Image files Image resizer](https://appvau.lt/tools/image-resizer/)

These tools exist because the same problem keeps turning up underneath the app: a photograph says more than the person sending it meant to. App-Vault is the iPhone side of that — an encrypted vault for the files that should not be in the camera roll at all. [What the vault does](https://appvau.lt/photo-vault/), [the cryptography behind it](https://appvau.lt/encryption/) are documented rather than asserted.

[Home](https://appvau.lt/) [Browser tools](https://appvau.lt/tools/) Photo metadata viewer and remover

GET STARTED

## Seal the vault.

Free to download. The free tier holds one file. Premium removes the limit — Weekly from $3.99 or Yearly from $29.99 with a 7-day free trial.

[Open App-Vault on iPhone](https://appvau.lt/download/)

---

HTML version: https://appvau.lt/tools/photo-metadata/
Structured data for this site: https://appvau.lt/api/v1/openapi.json · https://appvau.lt/llms.txt
Free to quote and reuse with a link back to the source URL above (CC BY 4.0).