The long version. What photographs, PDFs, Word files, spreadsheets and slide decks each record about the person who made them, which apps strip it and which do not, and what to do before you send anything.
A photograph is not just pixels. Cameras write a parallel record into the file describing where you were, what you were holding and when — and it travels with the image everywhere it goes.
Location data is not something you can see by looking at an image. It sits in a separate block called EXIF, alongside the camera model and shutter speed. Anyone who receives the file can read it in seconds, and on most phones it is on by default.
A modern phone records latitude and longitude to six decimal places, which resolves to roughly a metre. It often stores altitude too, which in a tall building narrows things to a floor. That is enough to identify a specific flat, not a neighbourhood.
Not holiday photos. The dangerous ones are ordinary shots taken at home: a pet on the sofa, a parcel that arrived, an item being sold second-hand, a whiteboard in a home office. People post those without thinking, and every one carries the same coordinates.
Disabling location for the camera stops new photos being tagged. Every photo already in your library keeps what it was given. If you are about to send an old one, check it rather than assume.
EXIF stands for Exchangeable Image File Format, a standard for storing structured information inside an image, written by the camera at the moment of capture. It was designed so photographers could sort their own libraries. It was not designed with sharing in mind.
Camera make and model, lens, exposure settings, orientation, the date and time to the second, and the software that processed it. On phones, almost always GPS. Professional bodies add a serial number. Some cameras record an owner name, typed in once during setup and forgotten.
A body serial number is a persistent identifier. Every photo that camera ever took carries the same one, which means a set of otherwise unconnected images can be tied together and traced back to a purchase record. Anonymous photographs are rarely as anonymous as intended.
Editors add their own. Adobe writes XMP, a second metadata block in XML. Photoshop writes an IPTC record. Each can hold a name, a copyright line, a city, and a document tracking ID that survives across saves.
Cameras write a small preview into the file so gallery apps can show it instantly. It lives in a second directory of the EXIF block. Some editors update it when you crop. Plenty do not, and simply leave the old one in place.
The pattern is always the same: someone crops an image to hide a detail, publishes it, and the embedded preview still holds the uncropped frame. It is recoverable by anyone who opens the file with a tool that reads EXIF, which is to say anyone who cares to look.
Pixelation is the risky one: where the hidden content is text in a known font, researchers have reconstructed it by searching for the rendering that pixelates to the same blocks. A heavy blur on a photograph is far harder to undo and often practically safe. Solid black is safer still, but only if the image is then flattened and re-exported — in a layered file or a PDF, the covered content usually still sits underneath.
Drop the file in above. If a preview is stored inside, this page renders it on screen so you can see exactly what a recipient could recover.
A screenshot is generated by your operating system, not a camera, so there is no lens or GPS data. What you do get is a capture timestamp, the display resolution and colour profile, and on some systems the software that made it.
Open a screenshot in an image editor to annotate or crop, and that editor writes its own block on save: its name, its version, sometimes a document ID, sometimes the registered user. A screenshot that started clean can pick up your name on the way out.
Notification banners, browser tabs, an account name in a corner, an autocomplete dropdown, a file path in a title bar, a second monitor reflected in a window. No tool can strip these, because they are part of the picture. Look at the whole frame before you send, not just the part you meant to capture.
iPhones save in HEIC unless told otherwise. It is a modern container that stores metadata as numbered items rather than a simple block, which is why many older tools quietly fail to read or strip it. This page parses HEIC properly.
GPS latitude, longitude and altitude; the exact capture time including time zone; the make and model; which of the several rear lenses was used; the iOS version; and a unique image identifier. Portrait and Live Photos add depth data and a short video segment.
iOS lets you remove location at the point of sharing, under Options at the top of the share sheet. It works, but it is per-share, it defaults back, and it only covers location — not device details or timestamps. It does nothing if you send the file another way.
Most converters copy the EXIF block across to preserve capture information. You end up with the same metadata in a different container. Check the output rather than assuming the conversion dropped anything.
Office files and PDFs keep a record of who made them, how long it took, who reviewed it and what was taken out. Almost none of it is visible when you read the document.
Every PDF holds Author, Title, Subject, Keywords, Creator and Producer, plus creation and modification timestamps. The author field is usually filled in automatically from the account name on the machine that made it. Nobody sets it deliberately, and almost nobody checks it.
PDFs can be updated by appending changes to the end of the file rather than rewriting it. The original content stays where it was. A file saved this way several times contains its own earlier versions, and text edited out can often be recovered. You can spot it: the marker that ends a PDF appears more than once.
Drawing a black rectangle over text in a PDF viewer adds a rectangle. It does not delete the text underneath, which stays selectable and copyable. This has produced real disclosures in court filings and published government reports. True redaction removes the content and then flattens the document.
PDFs can carry embedded JavaScript that runs on open, complete files attached inside them, actions that ask to launch a program, and reviewer annotations. All of these are legitimate features and all have been used by attackers. This page reports every one of them without rendering the document, so nothing inside it executes.
Rename one to .zip and open it and you will find a folder of XML. One file holds the author, the last person to save it, the title and the revision count. Another holds the company name and the total minutes the document has been open for editing.
A proposal that claims weeks of work and reports eleven minutes of editing tells a story. So does a contract with an enormous editing time, which suggests heavy internal negotiation before you saw it. Neither is something anyone intends to disclose.
Insertions and deletions are stored in the document body with the name of whoever made them and when. Deleted text is still there and still readable. Turning off the display hides them from you and from nobody else, which is how internal negotiating positions end up with the other side.
Reviewer comments live in their own part of the archive and survive being collapsed in the interface. Cleaning here removes the comment parts, accepts insertions and rejects deletions — the same result as accepting all changes in Word, without needing Word.
A normally hidden sheet is restored by right-clicking any tab and choosing Unhide. A very hidden sheet does not appear in that list and needs the developer tools, which stops a casual reader but nobody who is looking. Neither is protection.
The working. Cost bases, supplier rates, margin calculations, the assumptions behind a quoted number, staff details, an older version of the model. These get hidden rather than deleted because the visible sheets still depend on them.
Removing a sheet destroys data, and that is not a decision a tool should make silently. Hidden sheets are flagged clearly and left alone. The right fix is to build a fresh workbook containing only what the recipient should have, with values pasted in rather than formulas pointing at sheets you removed.
More than any other format, a deck is passed on. Each recipient sees the same properties: who made it, which company they work for, when it was last touched, how many revisions it went through. A deck sent to a client is often forwarded internally several times before anyone reads it closely.
Speaker notes, which are frequently far more candid than the slides. Slides hidden from the presentation but still in the file. Objects dragged off the edge of the canvas, invisible on screen and fully present in the file. Reviewer comments.
Blanks the document properties and removes comment parts. Speaker notes, hidden slides and off-canvas objects are content rather than metadata, so they are left alone. Delete those yourself before the deck goes outside.
Most CVs begin as someone else's file. The original author's name often survives every subsequent edit, which means your CV can arrive attributed to a stranger, or to the friend who sent you the template.
People tailor a CV per application. If the file is a PDF exported repeatedly from the same document, or a Word file edited in place with tracked changes on, the earlier tailoring can still be in there — salary figures, other companies' names, lines you removed because they were no longer true.
Creation and modification dates are readable by anyone. A file modified at two in the morning on a weekday, or created the day after a performance review, is information you did not intend to hand over.
Finish the document, run the checks, then export a fresh PDF rather than editing an old one. Clean it, and confirm the author field is empty before you attach it.
There is one rule that predicts the answer better than any list, because the lists go out of date with every app release.
If a platform re-compresses your image to save bandwidth, metadata is usually lost as a side effect. If it treats your upload as a file to be delivered intact, everything survives. This is why the same app behaves in two different ways depending on which button you press.
In most messengers, attaching an image through the gallery picker compresses it and strips most metadata. Attaching the same image through the document or file option delivers the original bytes, GPS and all. People reach for the document option precisely when quality matters, which is exactly when the original metadata is intact.
An email attachment is delivered byte for byte. A link to a file in cloud storage serves the original file. Neither strips anything, and neither warns you. These are the routes most often used for a CV, a contract or a scan — the files most likely to carry a name.
Behaviour changes between app versions without announcement, and differs by platform and region. Strip it yourself and it stops mattering what the platform does.
A thirty-second habit catches almost everything: look, then clean, then send.
The leak is different in every format, so memorising what to check in a JPEG will not help you with a spreadsheet. What transfers is the habit: before any file leaves your hands, open it somewhere that shows you what is inside, and only then attach it.
For anything visual this catches the most. Notification banners, open tabs, a name in a corner, a path in a title bar. No amount of metadata stripping helps with content that is in the picture.
Editing a file in place preserves its history. Exporting a new one from a clean source does not. For documents that matter, finish the work and then produce a new file rather than sending the working copy.
It is the looking step, made fast enough that you will actually do it. Drop the file in, read what came back, clean it, send it.
For some people this is an embarrassment. For others it is a disclosure, a fine, or a source being identified.
Tracked changes carrying internal negotiating positions. Redactions applied as a shape over text rather than a removal of it. Document properties naming a colleague, a client or a matter number.
Finish the document. Accept or reject every tracked change. Delete all comments. Remove content properly rather than covering it. Export a fresh PDF rather than sending a working copy. Confirm the author field is empty. Then attach it.
The check runs both ways. A document arriving from the other side may carry its own tracked changes and properties. Whether reading them is proper depends on your jurisdiction and rules of professional conduct — but knowing they are present is the first step to handling them correctly.
Privileged material should not be uploaded to a third-party service, whatever its retention policy says. This page never transmits the file, and you can verify that in the network tab before trusting it with anything.
GDPR defines personal data by what it is, not by whether it was disclosed deliberately. An author name, a device identifier and a set of coordinates embedded in a shared file are personal data being processed, and fall under the same obligations as any database field.
Files published on a website. Documents attached to outbound email. Photographs of staff or premises. Data shared with a processor or partner. Responses to subject access requests, frequently exported carrying the properties of whoever compiled them.
Uploading a document to an online processing service is itself a transfer to a third party, possibly out of the region, and needs its own assessment. Processing in the browser avoids the question because nothing is transferred.
This is a description of a common gap, not a compliance opinion. Your data protection officer or counsel should decide what your obligations actually are.
The author field of a document. The camera serial number in a photograph, which links every image that body ever produced. GPS coordinates from a picture taken inside a building. A printer identification pattern in a scan. A username embedded in a file path inside an office document.
Uploading a leaked document to your own site republishes its metadata to the world. Safer practice is to transcribe or re-render the content rather than publish the original, and to verify the replacement independently.
By the time a file reaches you the exposure has already happened, and may be logged somewhere in transit. Guidance to sources is worth more than any cleaning at your end: photograph a screen rather than screenshot it, retype rather than forward, avoid the original file where the content can be conveyed without it.
The same metadata that endangers a source can authenticate a document. Strip it for publication, but decide separately what to retain privately.
Office documents record the account name of whoever created and last saved them, the company name from the software licence, and how long the file was open. Photographs record the device. A scan may record the scanner. None of it is visible when you read the document.
Do not forward the file you have. Retype the content into a new document made somewhere unconnected to you, or photograph a screen with a device that has location disabled. A clean copy of the content beats a cleaned copy of the original, because cleaning can only remove what a tool knows to look for.
Metadata is one channel among several. The account you send from, the network you send over, the time you send it and the pattern of who had access are all part of the same picture. This page addresses the file. It cannot address the rest.
Established organisations publish detailed guidance for this situation, and secure submission systems exist that are designed for it. A free web page is a useful check, not a protection strategy.
The checker reads every field described above and reports the ones your file actually carries.