57 fields, grouped by where they live. For each one: which part of the file holds it, what it discloses about the person who made the file, and how much that matters. Written from the parsers on this site, so what it says a field contains is what this site reads out of it.
EXIF is written by the camera at the moment of capture and lives in a segment near the front of a JPEG, or as a numbered item inside a HEIC container. It survives copying, emailing and most editing. These are the fields that matter when a photograph leaves your hands.
| Field | Where it lives | Exposure | What it gives away |
|---|---|---|---|
| GPS latitude / longitude | GPS IFD, tags 1–4 | Identifies you | Where the photograph was taken, to roughly a metre. Stored as three rational numbers — degrees, minutes, seconds — plus a hemisphere reference. A photo taken indoors gives away the building; taken at home, it gives away your address. |
| GPS altitude | GPS IFD, tag 6 | Identifies you | Height above sea level. In a tall building this narrows a location to a floor, which combined with coordinates identifies a specific flat or office. |
| Camera owner name | Exif IFD, tag 0xA430 | Identifies you | A name typed into the camera during setup, usually years ago and long forgotten. Present on most professional bodies and some phones. |
| Body serial number | Exif IFD, tag 0xA431 | Identifies you | A permanent identifier unique to that camera. Every photograph the body has ever taken carries the same value, so a set of anonymous images can be linked together and traced to a purchase. |
| Lens serial number | Exif IFD, tag 0xA435 | Identifies you | The same problem as the body serial, and it persists even if the camera body is replaced. |
| Artist | IFD0, tag 0x013B | Identifies you | A photographer's name, often set once in the camera or added by cataloguing software on import. |
| Copyright | IFD0, tag 0x8298 | Identifies you | Almost always contains a personal or company name. |
| User comment | Exif IFD, tag 0x9286 | Identifies you | Free text. Because it is free text, people put anything in it, including notes never meant to travel with the file. |
| Image unique ID | Exif IFD, tag 0xA420 | Narrows you down | A per-image identifier. Not personal by itself, but it lets two copies of a photograph be matched even after renaming. |
| Camera make and model | IFD0, tags 0x010F and 0x0110 | Narrows you down | Identifies the device. Narrows an anonymous photographer to owners of one model, which matters more than it sounds in a small group. |
| Lens model | Exif IFD, tag 0xA434 | Narrows you down | Which lens was fitted, and on a phone which of the several rear cameras was used. |
| Date and time original | Exif IFD, tag 0x9003 | Narrows you down | Capture time to the second. Establishes where someone was at a precise moment when combined with the coordinates. |
| Time zone offset | Exif IFD, tag 0x882A | Narrows you down | The zone the camera was set to, which suggests the region even when GPS is absent. |
| Software | IFD0, tag 0x0131 | Identifies your tools | The firmware or editing application, with version. Reveals your toolchain and sometimes an OS version. |
| Maker note | Exif IFD, tag 0x927C | Narrows you down | A vendor-defined block with no public format. Can run to tens of kilobytes and has been found to contain focus points, shutter counts and serial numbers. |
| Embedded thumbnail | IFD1, tags 0x0201 and 0x0202 | Identifies you | A small preview stored alongside the full picture. If the photograph was cropped after capture and the editor did not regenerate it, this still shows the original, uncropped frame. |
EXIF is not the only place information hides in an image. Editing software adds layers of its own, each with a different format and a different set of fields.
| Field | Where it lives | Exposure | What it gives away |
|---|---|---|---|
| dc:creator | XMP packet | Identifies you | The document author in Adobe's XMP format, written by Photoshop, Lightroom and many others. Survives conversion between formats more reliably than EXIF. |
| photoshop:City / Country | XMP packet | Identifies you | A place name, often filled in automatically by cataloguing software that reverse-geocoded the coordinates. Removing GPS but leaving XMP still discloses the location. |
| xmpMM:DocumentID | XMP packet | Narrows you down | A tracking identifier that persists across saves and exports, linking every derivative of an original file. |
| xmp:CreatorTool | XMP packet | Identifies your tools | The application and version that produced the file. |
| IPTC record | APP13 segment | Narrows you down | A Photoshop-specific block holding captions, keywords, bylines and credit lines, used across the news industry. |
| PNG text chunks | tEXt, iTXt, zTXt | Narrows you down | Free-text key and value pairs. Design and diagram tools routinely write the project name, the author, or the licensed user into these on export. |
| PNG eXIf chunk | eXIf | Identifies you | A complete EXIF block carried inside a PNG, usually copied across when converting from JPEG. People assume PNG has no EXIF; it can. |
A PDF stores its metadata in an information dictionary near the end of the file, often duplicated as an XMP packet. Beyond metadata, the format allows several things to be carried inside a document that are worth knowing about before you open it.
| Field | Where it lives | Exposure | What it gives away |
|---|---|---|---|
| /Author | Information dictionary | Identifies you | Populated automatically from the account name of the machine that created the file. Almost nobody sets this deliberately and almost nobody checks it. |
| /Company | XMP or custom properties | Identifies you | Carried over from the Office document the PDF was exported from. |
| /Creator | Information dictionary | Identifies your tools | The application the document was authored in, before conversion. |
| /Producer | Information dictionary | Identifies your tools | The library that wrote the PDF, with version. Useful for fingerprinting a workflow. |
| /CreationDate and /ModDate | Information dictionary | Narrows you down | Timestamps to the second, with time zone. Reveal when a document was drafted and last touched, which can contradict what a covering email says. |
| /Title, /Subject, /Keywords | Information dictionary | Narrows you down | Often carries an internal file name, a matter reference or a working title never meant to be seen. |
| Incremental saves | Multiple %%EOF markers | Identifies you | A PDF can be updated by appending to it rather than rewriting it, which keeps the earlier version in the same file. Text that was edited out can often be recovered. Count the %%EOF markers: more than one means earlier states are present. |
| /JavaScript | Names tree or annotations | Identifies you | Executable script that runs when the document opens. A legitimate feature, and a common malware delivery route. |
| /EmbeddedFile | Names tree | Identifies you | A complete separate file packaged inside the PDF. Whatever it is travels with the document. |
| /Launch | Action dictionary | Identifies you | An action that asks to run an external program. |
| Annotations | /Subtype /Text, /Popup, /FreeText | Narrows you down | Reviewer comments. They remain in the file whether or not your viewer chooses to display them. |
The modern Office formats are ZIP archives containing XML. Rename a .docx to .zip and you can read every field below in a text editor. That accessibility is exactly why these documents disclose so much.
| Field | Where it lives | Exposure | What it gives away |
|---|---|---|---|
| dc:creator | docProps/core.xml | Identifies you | The original author. Frequently the person whose template you started from rather than you. |
| cp:lastModifiedBy | docProps/core.xml | Identifies you | Whoever saved it last. On a document passed around internally, this names a colleague to an external recipient. |
| Company | docProps/app.xml | Identifies you | Taken from the Office licence. Discloses the organisation even when the document is meant to be anonymous. |
| Manager | docProps/app.xml | Identifies you | Rarely populated, and unmistakably personal when it is. |
| TotalTime | docProps/app.xml | Narrows you down | Minutes the document has been open for editing across its life. A proposal claiming weeks of work that reports eleven minutes tells its own story. |
| cp:revision | docProps/core.xml | Identifies your tools | How many times the document has been saved. |
| dcterms:created / modified | docProps/core.xml | Narrows you down | Creation and last-save timestamps. |
| Template | docProps/app.xml | Narrows you down | The template the document was built from, sometimes including a full network path and a client name. |
| Tracked insertions | w:ins in document.xml | Identifies you | Every addition, attributed by name and timestamped. Content, not metadata — it stays in the file. |
| Tracked deletions | w:del in document.xml | Identifies you | Every removal, with the deleted text intact and readable. Turning off the markup display hides this from you and from nobody else. |
| w:author | Revision and comment markup | Identifies you | The names of everyone who edited or commented, listed inside the document body. |
| Comments | word/comments*.xml | Identifies you | Reviewer comments in a separate part of the archive. They survive being collapsed in the interface. |
| Hidden sheets | state="hidden" in workbook.xml | Identifies you | A sheet excluded from view but present in the file, restored by right-clicking any tab. Usually holds the working behind the visible numbers. |
| Very hidden sheets | state="veryHidden" | Identifies you | Not shown in the Unhide dialog and restorable only through the developer tools. Stops a casual reader and nobody who is looking. |
A ZIP is made by compressing a folder, which means it carries everything that folder contained — including the files an operating system creates without asking, and anything a previous piece of work left behind.
| Field | Where it lives | Exposure | What it gives away |
|---|---|---|---|
| .env | Archive member | Identifies you | Environment configuration. Holds API keys, database passwords and access tokens in plain text by convention. |
| .git directory | Archive member | Identifies you | The complete history of a project. Anything ever committed remains recoverable, including credentials removed in a later commit. |
| Private keys | id_rsa, *.pem, *.p12, *.pfx | Identifies you | A private key grants whatever access it was issued for to whoever holds it. |
| Credential directories | .aws, .ssh, .npmrc, .netrc | Identifies you | Service login tokens, stored unencrypted. |
| Database dumps | *.sql, *.dump, *.bak | Identifies you | Backups contain everything, including records deleted from the live system afterwards. |
| .DS_Store | Archive member | Narrows you down | A macOS folder record listing every file that was in the directory, including ones removed before sending. |
| Thumbs.db | Archive member | Narrows you down | A Windows cache holding small copies of images that were in the folder, sometimes including deleted ones. |
| Editor leftovers | *.swp, *.orig, *~ | Narrows you down | The previous version of a file, sitting beside the current one. |
| Log files | *.log | Narrows you down | Frequently contain file paths, user names, internal hostnames and occasionally credentials. |
The checker on the home page reads every field listed here and reports the ones your file actually carries, with a privacy score and a plain-English summary of what someone could work out. It runs in your browser, so a confidential document is never uploaded in order to be examined.