What File Metadata Reveals About You

Inspect before you share. DevOkk’s Metadata Viewer reads those tags in the browser. It does not strip them. Stripping is the next article and the next tool. Looking first is how you decide whether the next tool is needed.

Metadata is not the pixels

A JPEG is a compressed image plus a header that can hold EXIF (and sometimes IPTC or XMP). The image preview shows faces and streets. The header can show the coordinates of the street, the lens, whether flash fired, and the exact time. You cannot see coordinates by squinting at the photo.

A PDF is a page description plus a document information dictionary and often XMP. The pages show the contract. The dictionary can show who saved it, in which build of Word or Acrobat, and when. Printers and “Save as PDF” pipelines are sloppy about this.

Office files (and many exports from them) are worse: core properties, custom properties, sometimes leftover tracked-changes metadata even after you thought you accepted all changes. This article will not pretend a browser widget reads every proprietary blob. It will tell you to look, then to strip, then to open the result.

Social apps sometimes strip EXIF on upload. Email clients usually do not. Slack and issue trackers usually do not. “The platform will clean it” is not a process.

Photos: GPS, camera, and time

GPS. If the camera app had location on, EXIF can contain latitude, longitude, and altitude. A photo of a living room can be a photo of an address. A photo of a “secret” workshop can be a map pin. This is the tag people mean when they say they were surprised.

Camera and phone. Make, model, sometimes serial-ish identifiers, lens, orientation. Harmless for a product shot. Less harmless if you are publishing from a device you did not intend to advertise, or if a serial can be correlated with other files.

Timestamps. Date taken versus date file-modified. A photo “from the event” with a taken-at a week earlier is a small lie the file will not help you keep. A sequence of photos with GPS and time is a trail.

Thumbnails. Some files embed a smaller JPEG that was generated earlier. You can crop the main image and still ship an old thumbnail. Inspectors that list embedded previews are doing you a favor.

Screenshots. Usually no GPS. Still can include device or app metadata, and they still show the screen contents - notifications, a password manager, a customer list. Metadata is not your only problem.

Open Metadata Viewer, drop the photo, expand the categories. Look for GPS, camera, and date fields before you argue about whether the picture is “just a picture.”

Documents: authors, software, and leftover people

PDFs and office exports routinely store:

• Author and last author
• Title and subject that came from the first save
• Producer / creator software and version
• Creation and modification timestamps
• Keywords and comments

A “redacted” PDF that still says Author: Jane, Legal is not fully redacted. A resume exported from a template that still has the previous candidate’s name in properties is a real-world failure mode.

Tracked changes and hidden slides are content, but they travel with the file the same way. A metadata viewer may not surface every hidden layer. If the document was collaborative, assume you need a clean export or a flatten, not just tag deletion.

Images inside a PDF can carry their own EXIF. Stripping only the PDF info dictionary may leave a photo’s GPS intact inside the container. Inspect the file you will actually send, not the source .docx you no longer have.

Inspect first, in the browser

The circular failure is: upload a file to a website to see if it is safe to upload. Use a local viewer.

1. Keep the original. You are only reading.
2. Open Metadata Viewer. No account.
3. Add the file. Wait until categories populate.
4. Expand GPS, camera, author, timestamps, software. Copy anything surprising into your own notes if you need a record of what you found - not into a public ticket with the file still attached.
5. Decide: share as-is, strip, or do not send. “Looks fine in Preview” is not a decision.

Very large files can strain the tab. If the browser complains, you still should not jump to a random cloud inspector. Split the PDF, or inspect a copy on a machine with more RAM.

Viewing does not prove you found everything. Exotic camera maker notes and some raw formats are uneven. Absence of a GPS field is good news; it is not a certificate that no other identifying tag exists. When the file matters, strip the common classes anyway - see How to Remove EXIF and Document Metadata.

What viewing does not change

The file on disk is the same after you look. Recipients who get that file get the tags you just saw.

A compressed or converted copy may or may not keep EXIF. Some compressors preserve tags; some rewrite the image and drop them; some add their own “processed with” software field. After any transform, inspect that output. Do not assume image compressor or PDF Compressor is also a metadata tool. They are size tools. Chain them: inspect → strip → compress if you need both privacy and a smaller attachment.

A filename can leak too (acme-layoff-draft-v3.pdf). That is not EXIF. Rename on purpose.

Look at the file before you attach it

Drop the file you were about to attach into Metadata Viewer. If you see GPS, an author, or a camera you did not mean to publish, go to Metadata Remover and then inspect the cleaned file once.

For a short list you can run every time, use A Practical Privacy Checklist Before You Share a File. Looking is the step people skip. It is also the only way the rest of the list means anything.