Strip GPS, camera and date data from photos and videos. Entirely in your browser.
Live: https://withrvr.github.io/remove-metadata/
Every photo and video from a phone carries hidden data: the exact GPS location, the phone model and its serial numbers, the date and time to the second, the editing app, sometimes a small preview of the uncropped original, or a hidden video clip. Send the original file to someone and they can read all of it.
This tool shows you what a file gives away, then hands you a clean copy. It runs 100% on your device.
- Nothing is uploaded. There is no server. A strict Content Security Policy only lets the page run its own code, and the single outside request it can make is a download you start by pasting a link. Clean a file with the Network tab open in DevTools: zero requests.
- Works offline. After the first visit it is cached on your device (PWA). Turn off Wi-Fi and it still works. You can install it like an app.
- No quality loss. Images are never decoded and re-encoded. Videos are never re-muxed. Only metadata bytes are removed or blanked; every pixel and every video frame is copied byte for byte.
- Verified. After cleaning, each file is scanned again from scratch and the number of remaining fields is shown.
- Fast with huge files. A 4 GB video is cleaned in seconds using a few MB of memory.
- Load from a link. Paste an image or video URL (or open
?url=https://...) and your browser downloads it straight from that site, no proxy in between. Works for sites that allow cross-site reads (CORS); for the rest you get a clear "save it and drop it here" message. - Full report, like ExifTool. Every field grouped and searchable, plus file info (dimensions, megapixels, aspect ratio, duration, codecs), SHA-256 / SHA-1 / MD5 of the original and the clean copy, the full ICC color profile, JFIF header and stream details. Export as JSON or CSV.
- Remove everything mode. By default rotation and color profile are kept so photos look identical. One switch removes those too and leaves only the image or video.
- Zero dependencies. About 2,400 lines of plain JavaScript. No build step, no npm packages, no CDN, no analytics. Read it in an evening.
| Format | What is removed | How |
|---|---|---|
| JPEG | EXIF (GPS, device, dates, serials, thumbnail), XMP, IPTC, Photoshop blocks, comments, MPF, motion-photo / HDR data appended after the image, all other APPn blocks | Segments are dropped; image segments copied as-is |
| PNG | tEXt / zTXt / iTXt (incl. AI prompts like Stable Diffusion parameters), eXIf, tIME, XMP, unknown ancillary chunks |
Chunks are dropped |
| WebP | EXIF, XMP, unknown chunks | Chunks dropped, VP8X flags and RIFF size fixed |
| GIF | Comments, XMP, unknown application blocks (animation loop setting kept) | Blocks dropped |
| HEIC / HEIF / AVIF | EXIF and XMP items | Overwritten in place with a valid empty block (keeps strict decoders happy) |
| MP4 / MOV / M4V / 3GP | udta and meta boxes (title, location, make/model, software, Apple keys), XMP, Sony blocks, creation/modification dates in mvhd/tkhd/mdhd, leftover data in padding, GoPro/dashcam GPS telemetry tracks |
Boxes renamed to free and zeroed in place, timestamps zeroed, telemetry samples zeroed. Offsets never move |
| WebM / MKV | Tags, title, recording date, muxing/writing app | Replaced in place by EBML Void elements of the same length |
Kept on purpose (switch on "Remove everything" in Options to drop these too):
- the rotation flag, so photos aren't shown sideways (written as a minimal EXIF containing only
Orientation) - the ICC color profile, so colors look identical
No build step. Any static server works:
git clone https://github.com/withrvr/remove-metadata
cd remove-metadata
python3 -m http.server 8000
# open http://localhost:8000(Opening index.html straight from disk won't work because browsers block ES modules on file://.)
- Push this folder to a GitHub repo.
- Repo Settings → Pages → Build and deployment → Source: Deploy from a branch, branch
main, folder/ (root). - Wait a minute. It's live at
https://<user>.github.io/<repo>/.
All paths are relative, so it works under any sub-path. When you change files, bump VERSION in sw.js so returning visitors get the update.
npm test # cleans every file in tests/fixtures, re-scans the output, fails if anything is left
python3 tests/check-identical.py # proves decoded pixels and A/V streams are bit-identical (needs Pillow, pillow-heif, ffmpeg)
python3 tests/make-fixtures.py # regenerates the metadata-stuffed test files (needs exiftool + ffmpeg)The fixtures were also checked with ExifTool: after cleaning, it finds no location, device, person, date or software fields in any of them.
index.html the page (strict CSP lives here)
assets/app.js UI: drop/paste/pick, report, redaction animation, downloads, zip
assets/app.css styles, light + dark
core/index.js format detection (by bytes, never by file name) + entry points
core/jpeg.js png.js webp.js gif.js isobmff.js matroska.js one module per container
core/exif.js TIFF/EXIF reader + minimal orientation writer
core/readers.js XMP, IPTC, ICC readers (display only)
core/icc.js full ICC color profile reader
core/hash.js SHA-256 / SHA-1 (WebCrypto) and MD5 for the report
core/url.js load a file from a link (CORS, no credentials, no referrer)
core/zip.js tiny store-only zip writer (entries dated 1980-01-01, so the zip leaks no time either)
sw.js offline cache
tests/ fixtures, Node test runner, pixel/stream identity check
ExifTool is the gold standard for reading metadata, and it is what this project is tested against. But shipping it in the browser means a Perl interpreter in WASM (several MB), and its default writer rewrites files in ways that can move data around. Removing metadata safely only needs a careful walk over each container's structure, which is small, fast, and easy to audit.
- Links only load from sites that allow other websites to read their files (CORS). There is deliberately no proxy, since a proxy would see your files.
- RAW formats (CR3, NEF, ARW, DNG), TIFF, PDF and Office files are not supported yet.
- Subtitle tracks are kept (they are content). Some drones write GPS into a subtitle track; remove that track with a video editor if that matters to you.
- Attachments inside MKV files (fonts, cover art) are kept and listed in the report.
- Video names of internal handlers (like "VideoHandler") stay; they are the same in every file and identify nobody.
MIT. Font: Bricolage Grotesque, SIL Open Font License (assets/fonts/OFL.txt).