A photograph is not only an image. Attached to it, in a region of the file most people never see, is a structured record of the circumstances in which it was made.
That record has a name — EXIF, for Exchangeable Image File Format — and it is more detailed than almost anyone expects. This is a guide to what is actually in there, written from the inside of a parser we built by hand rather than from a summary of other summaries.
Where you were
The single most consequential field, and the one worth understanding first.
Cameras and phones that have a location fix write it into the file as GPS coordinates. Not a city. Not an approximate area. Latitude and longitude, stored as degrees, minutes and seconds, with fractional seconds.
A test file we use during development encodes coordinates that resolve to 31.52040° N, 74.35870° E. That level of precision — five decimal places — locates a point to roughly a metre. It does not identify a neighbourhood. It identifies which side of a building you were standing on.
Alongside the coordinates you will often find:
- GPSAltitude — height above sea level, which distinguishes a ground floor from a fourteenth
- GPSTimeStamp and GPSDateStamp — a UTC time separate from the camera’s own clock
- GPSImgDirection — the compass bearing the lens was pointing
- GPSDestBearing — on some phones, where you were heading
Take a series of photographs over a few weeks and the coordinates alone describe where you live, where you work, when you leave, and which route you take. No individual photograph feels revealing. The set is a movement history.
What you photographed it with
The camera identifies itself, and in more detail than a model name.
- Make and Model — “Canon”, “EOS R6”
- LensMake and LensModel — often including the exact focal-length range
- BodySerialNumber — the serial number of the camera itself
- LensSerialNumber — the serial number of the lens
Those last two deserve more attention than they get, because they are the fields that turn “a photo taken on a Canon” into “a photo taken on this Canon.”
A serial number is a persistent, unique identifier that links every photograph a body has ever taken. Anonymous images posted to different places under different names, with no other connection between them, share a serial number. If any one of those images is ever tied to a real identity — a listing, a warranty claim, a photograph posted to a personal account — the rest follow.
Photographers publishing work anonymously, journalists protecting a source, anyone selling equipment second-hand with sample images attached: this field matters, and virtually no consumer software surfaces it.
When, and on what schedule
Three timestamps, usually, and they are not redundant:
- DateTimeOriginal — when the shutter fired
- DateTimeDigitized — when it was written to storage
- DateTime — when the file was last modified
Together they distinguish an original from an edited copy, and they establish sequence. Combined with GPS timestamps, which are in UTC while the camera’s clock is usually local, they can also reveal the time zone you were in — occasionally contradicting a stated location.
What you did to it afterwards
- Software — the application that last wrote the file. “Adobe Photoshop 26.2”, “Snapseed”, a phone’s built-in editor.
- ProcessingSoftware, HostComputer — on some files, the machine as well as the application.
This is how an image presented as unedited is frequently shown to be otherwise, and how a leaked document’s origin has more than once been narrowed to a specific workstation.
Who claims it
- Artist and Copyright — often auto-filled from a camera’s setup menu with a full legal name
- XPAuthor, XPComment, XPKeywords — Windows-specific fields written by the operating system’s file properties dialog
People configure a camera’s copyright field once, years ago, and forget it exists. It travels with every frame thereafter.
The photographic settings
Exposure time, aperture, ISO, focal length, flash, metering mode, white balance. These are the fields EXIF was designed for, and they are the least sensitive things in the file — genuinely useful for learning, and worth keeping when you share work with other photographers.
They are also, in aggregate, mildly identifying. A body that shoots consistently at particular settings has a signature of a sort. This is a stretch compared with a serial number, but it is not nothing.
The other three metadata systems
EXIF is the most discussed, and it is not the only one. A single file frequently carries several formats at once, and a tool that strips one may leave the others untouched.
- XMP — Adobe’s XML-based standard. Holds edit histories, ratings, keywords, and often a full copy of fields that also exist in EXIF.
- IPTC — the news and publishing standard. Captions, credits, bylines, locations written by hand.
- Comment segments — free text, occasionally containing a full local file path, which reveals a username and a directory structure.
Our EXIF tool flags all three separately from EXIF, because “we removed the metadata” is a claim that needs to specify which metadata.
PNG and WebP carry it too
The assumption that only JPEGs have metadata is widespread and wrong.
PNG stores EXIF in an eXIf chunk, and carries tEXt, iTXt and zTXt chunks that commonly hold software names and comments. WebP stores it in EXIF and XMP chunks inside its RIFF container. Screenshots, exported graphics and modern web images all routinely carry a record of the software that produced them.
What the platforms do
Most large social platforms strip most EXIF on upload — but “most” is doing real work in that sentence, and the behaviour differs by platform, by upload path, and over time. Some strip GPS and keep camera data. Some strip everything from the displayed image while retaining the original. Some strip nothing from files sent as attachments rather than as photos.
The practical rule: do not rely on the platform. Whether a given service strips a given field this month is not something you can verify from the outside, and it is not something they commit to. Strip it yourself before uploading and the question stops mattering.
What to actually do
Before sharing publicly — strip location and serial numbers at minimum. Keep the exposure settings if you like; they cost you nothing.
Before sending a photograph of a document — strip everything. There is no reason a scan of a form needs to carry the coordinates of your desk.
Before selling equipment — check the serial number fields in your sample images. This is the one nobody thinks of.
When receiving photographs — the same data is present in what other people send you, which is worth knowing both for what it tells you and for what you might inadvertently republish.
Before submitting anything to an insurance claim, a listing, or a public forum — these are the three contexts where photographs are most often examined closely by someone with an interest in what they reveal, and where the timestamps and coordinates most often contradict the story the sender intended to tell.
A last note on why this is worth the minute it takes. None of these fields were added to spy on you. GPS tagging exists because organising ten thousand holiday photographs by location is genuinely useful. Serial numbers exist for warranty claims and theft recovery. Software fields exist so editors can track a workflow. Every one of them was a reasonable idea in the context it was designed for.
They become a problem only at the point the file leaves that context — when a photograph taken for yourself is published for everyone. The metadata does not know it has crossed that line. You have to.
You can read every one of these fields, and remove them, in your browser. Nothing is uploaded, and stripping is lossless — not a single pixel changes.
See what your own photos are carrying with the EXIF viewer and remover.