What Your Photos Actually Reveal: A Field Guide to EXIF Metadata

By Andrew Butson · July 2, 2026 · 8 min read

Every photo you take carries more than the picture. Digital cameras and phones write a layer of data directly into the image file itself, called EXIF (Exchangeable Image File Format), and it is invisible unless something goes looking for it. Most of that data is mundane: shutter speed, aperture, ISO, white balance. Some of it is not.

The fields worth worrying about are the ones that record where you were, when you were there, and what device was in your hand at the time. Combine a GPS tag with a timestamp and you don't have camera trivia any more. You have a log entry. This is not a hypothetical risk cooked up by security consultants; it is precisely what the format was designed to capture, and it travels with the file by default, through every app, email, and USB stick, until something deliberately removes it.

This guide covers what is actually inside a typical photo, why some of those fields matter more than others, which channels tend to scrub it and which don't, and how to check a specific file yourself in a few seconds without handing it to a stranger's server first.

What EXIF actually is

EXIF is a block of tagged data embedded inside the image file itself, the same JPEG or TIFF you're looking at, not a separate sidecar. Camera and phone firmware writes it automatically at the moment of capture, with no prompt and no way for you to opt out at the point of shooting. It was standardised in the 1990s for photography workflows (matching lenses to exposures, sorting a shoot by timestamp), and phone manufacturers inherited the format wholesale, adding fields the original standard never anticipated, like precise GPS coordinates.

Many files also carry a second and third layer alongside EXIF: XMP (Adobe's Extensible Metadata Platform) and IPTC (a older newsroom standard for captions and credits). These can hold keywords, author names, copyright strings, edit history from apps like Lightroom or Photoshop, and — this is the part people miss — sometimes their own independent copy of GPS coordinates. An editing tool that dutifully strips the EXIF GPS tag can leave the XMP copy completely untouched, because it never thought to look there.

The fields that actually matter

Not every EXIF tag carries the same risk. A handful are worth knowing by name, because they are the ones that turn a photo from a picture into a data point:

• GPSLatitude / GPSLongitude / GPSAltitude: coordinates precise enough to resolve to a specific building, often to rooftop accuracy. This is the single highest-stakes field in the whole format.
• DateTimeOriginal: the exact date and time the shutter fired, down to the second. Paired with GPS, it becomes a record of exactly where you were at a specific moment.
• Make, Model, and on many cameras SerialNumber: identifies the exact device, and on some systems the specific physical unit, that took the photo.
• LensModel and related lens tags: narrows the device further and, for enthusiasts with distinctive kit, can be its own fingerprint.
• Software: the tool that last touched the file. Often a harmless breadcrumb, occasionally a giveaway that an image was edited.
• Embedded thumbnail: many JPEGs carry a small preview image generated at the time of the last save. If you crop or redact the main image but the file was re-saved by a tool that didn't regenerate the thumbnail, the old thumbnail can still show what you cropped out.
• XMP / IPTC fields: caption, keyword, author/creator name, and sometimes a redundant GPS block that survives even after the primary EXIF tags are removed.

Why a photo taken at home is the worst case

The scenario that matters most in practice is also the most ordinary: a photo taken inside or just outside your own house. The GPS tag on that file doesn't approximate your neighbourhood. It resolves to your specific address, often accurate to a few metres. Post that file somewhere it isn't scrubbed, and you've published your home address to anyone who thinks to check, attached to a picture that looks completely innocuous on screen.

The same logic applies to a child's school run, a workplace, a partner's flat, or anywhere else you'd rather not have pinned on a map. None of this requires anyone to be watching you specifically. It just requires that the file end up somewhere a metadata field gets read, which is a lower bar than most people assume.

Who actually strips this stuff

Coverage here is genuinely uneven, and the differences matter more than most privacy advice acknowledges. The large mainstream social platforms generally strip GPS and much of the rest of the EXIF block from photos you post publicly. It's been a fairly consistent industry practice for years, largely in response to exactly the stalking and doxxing risks above. That is a real mitigation, but it is not a universal one and platforms change behaviour without announcing it, so it's not something to rely on for a specific sensitive photo.

Messaging apps are much less consistent. Sending a photo through the normal compressed "photo" path often strips or reduces metadata as a side effect of re-encoding it for a smaller file size. But the same app sending the identical file as a "document" or "file" attachment frequently preserves the original bytes untouched, EXIF and all, because that path is designed to be lossless. Email is the clearest case: attaching a photo to an email essentially never strips anything. It's a straight file transfer, and whatever was in the file when you attached it is what arrives.

The practical takeaway isn't to memorise a table of which app does what: that table changes. It's to stop assuming a photo has been cleaned just because it went through some app on its way to its destination, and to check the file itself when it actually matters.

Checking a file without handing it to anyone

The most common way people check a photo's metadata is to upload it to a website that promises to show the EXIF data, which is a strange way to protect your privacy, since you've just handed the sensitive file to a third-party server to find out whether it's sensitive. If the goal is confirming that a photo doesn't reveal your location before you send it, uploading it somewhere first defeats the point before you've even started.

Morphr's /inspect tool reads a file's metadata entirely inside your browser, using WebAssembly: the file is decoded and parsed on your device and never leaves it. You can confirm this yourself: open your browser's DevTools, switch to the Network tab, drop a photo onto /inspect, and watch. No request goes out. The report groups what it finds by category (location, camera and device, timestamps, software, and anything else) and flags the fields that are personally identifying, like GPS coordinates, so you're not left parsing raw tag names to work out what matters.

How converting a photo strips it

Re-encoding an image is, incidentally, one of the most reliable ways to remove EXIF data, because the process rebuilds the file from the decoded pixels rather than copying the original bytes forward. When you convert a HEIC or JPEG to another format, the encoder writes a fresh file from the raw pixel data: GPS tags, timestamps, device identifiers, and the embedded thumbnail generally don't survive that round trip, because there's no step where they'd be carried across. This is a side effect of conversion, not a dedicated privacy feature, so it's worth confirming rather than assuming, which is exactly what running the converted file back through /inspect is for.

Frequently asked questions

Do screenshots contain EXIF or GPS data?

No. A screenshot is a fresh image generated by the operating system's screen capture, not a camera photo, so it has no GPS, camera model, or capture-device EXIF fields to carry. It may still have a creation timestamp and, on some systems, a small amount of metadata about the app it was taken in, but the location risk that applies to camera photos doesn't apply here.

If a platform strips EXIF from the photo it displays, does it still keep the original data somewhere?

That's outside what a user can verify from the outside. Stripping metadata from the file served publicly says nothing about what a platform retains internally, and policies vary and change. Treat "stripped from the public copy" and "never retained" as two different claims; only the first is something you can actually confirm yourself, by inspecting the downloaded file.

Can I remove just the GPS tag and keep the rest of the EXIF data, like the camera and lens info?

Some dedicated metadata editors let you edit individual tags selectively. Morphr's approach is simpler and more conservative: /inspect's "download clean" option strips the fields flagged as personally identifying, and converting to another format strips the lot via re-encoding. If you specifically want to keep non-sensitive tags like lens model, you'll need a tool built for selective editing rather than a general converter.

If I delete a photo from my phone, does that remove the EXIF from copies I already sent?

No. Once a file has left your device — sent, uploaded, shared — any copy that exists elsewhere keeps whatever metadata it had at the moment it was copied. Deleting your local original has no effect on files already sitting in someone else's inbox, chat history, or downloads folder.