What EXIF, IPTC and XMP metadata reveal about your photos
In short: a photo file has two parts: the image, and a set of text fields about the image. Those fields are written automatically by cameras, phones and editing apps, and they can include the exact place a photo was taken, the device that took it, the time to the second and the name of its owner. They travel with the file unless something removes them.
Where the information lives
Image formats reserve space for data that is not part of the picture. JPEG commonly stores metadata in application segments; PNG can contain text and EXIF chunks; WebP and HEIC have dedicated container entries. Descriptive fields are usually invisible, but orientation tags and color profiles can affect how an image is displayed. Removing them can change its appearance.
Three standards account for almost all of it: EXIF, IPTC and XMP. They overlap — the same author name or location can be written in more than one of them — so removing one block is not always enough.
EXIF: what the camera records
EXIF is written by the camera or phone at the moment of capture. A typical photo from a phone contains fields like these:
| Field | Example | What it reveals |
|---|---|---|
GPSLatitude, GPSLongitude | 40.4168 N, 3.7038 W | Where you were, often to within a few meters |
GPSAltitude | 657 m | Recorded altitude; not a reliable indication of a building’s floor |
DateTimeOriginal | 2026:03:14 08:12:31 | When you were there, to the second |
Make, Model | Apple, iPhone 15 Pro | The device you use |
Software | 17.4 | The operating system or app version |
ExposureTime, FNumber, ISO | 1/120 s, f/1.8, 64 | Camera settings: harmless on their own |
Altitude needs context: GPSAltitudeRef specifies its reference, and the recorded value can be imprecise. It is not a measurement of height above the building’s ground floor.
Some cameras also write a serial number for the body or lens, and many files include a small preview image of the photo. Not every editing app updates that preview when you crop, so in some files it can still show parts of the picture you cut out.
IPTC: captions, credits and places
IPTC metadata was designed for news agencies, to keep captions and rights information attached to photos as they moved between newsrooms. It is usually written by people, through an editing or cataloguing app, rather than by the camera. Common fields are the creator’s name, a copyright notice, contact details, a caption, keywords and a written location: city, region and country.
A written location is easy to overlook. A photo with its GPS removed can still say “Madrid, Spain” in its IPTC fields.
XMP: the catch-all
XMP is an XML-based format introduced by Adobe that can carry any of the above, plus edit history, ratings, labels and the name of the software used. Photo editors and cataloguing apps write it, and they often copy EXIF and IPTC values into it. That duplication is why a cleaning tool has to remove all three: a photo can have its GPS removed from EXIF and still carry the same coordinates in XMP.
Why it matters
None of these fields is secret on its own. Together, and across several photos, they can tell a stranger a lot:
- Where you live or work. Photos taken at home with GPS enabled may contain coordinates precise enough to identify the building.
- Your routine. Dates and times show when you are usually somewhere — or away.
- That photos may come from the same device. A matching camera or lens serial number can help link images posted under different names. A shared device model or software version is only a broad clue: many people use the same ones. None of these fields alone proves who took a photo, and metadata can be edited.
- Who you are. An author or copyright field set years ago in a camera menu or editing app keeps adding your name to every photo.
Many large platforms remove most of this from the copy they show, but plenty of channels pass the original file along untouched. When does photo metadata survive sharing? goes through the common cases.
How to see what a photo contains
Most operating systems show part of the metadata: the Info panel in Photos on iPhone and Mac, the Details tab of a file’s Properties in Windows, or the details view in Google Photos. For a fuller picture, drop the image into delexif: each photo gets a card that groups what was found into location (with a map link), device, capture data and authorship.
That card is a summary of the four groups most likely to identify you, not a full dump of every field. JPEG Lossless cleaning goes further than the summary: it removes EXIF/XMP APP1 segments, IPTC APP13 segments and free-text COM comments, including fields not listed on the card. It preserves ICC and other non-targeted segments. Redraw exports decoded pixels without copying the original metadata blocks. Neither the summary nor a successful check is a forensic inventory of every possible hidden field. The other guides explain how the two cleaning methods work and how to remove location on each platform.
Inspect a synthetic file, then check the copy
Download the synthetic JPEG input. Its 1 × 1 pixel image carries invented test values; it is not a photo of a real location or person. The metadata reader reports:
Make: TestCam
Latitude: 40.5
Longitude: -3.7
XMP creator: Example Author
XMP rights: Synthetic example; free to reuseThe file also has a JPEG comment and 23 bytes after the main image. Load it into delexif, choose Lossless and download the copy. Compare it with the exact expected output.
On 21 October 2026, delexif’s JPEG Lossless implementation and structure reader were run against this sample, with metadata read by exifr from the file bytes. The 1,359-byte input became a 633-byte JPEG: EXIF, XMP, the comment and appended bytes were removed, while the compressed scan data stayed identical. JFIF version, resolution and thumbnail-size fields remained. The recorded fields, file sizes and SHA-256 hashes let you compare the exact files.
This verifies that known fields in a deliberately constructed example were removed. It does not prove anonymity, remove visible clues in the pixels or test every camera’s private metadata.
Sources and scope
Primary documentation checked on 21 October 2026. The downloadable example is synthetic; the recorded test does not establish the behavior of every photo, device or sharing service.
- CIPA standards: Exif and Multi-Picture Format — camera metadata and multi-image structures.
- IPTC Photo Metadata Standard — creator, rights, descriptions and location properties.
- Adobe XMP specifications — XMP properties and their storage inside image formats.
Check a photo before you share it: drop it into delexif to see its location, device and date, and download a clean copy. The image is processed in your browser and never uploaded by the tool.