# Image Scrub URL: https://discuvr.org/image-scrub/ Last updated: 2026-11-07 See every hidden metadata field in your photo - GPS, camera serial, AI prompts - strip it, convert (HEIC to JPG), resize. No upload, nothing stored. A photo straight off a phone usually carries the exact coordinates where it was taken, the time to the second, the camera's serial number and often the owner's name. An image out of a generator carries the prompt. This shows you every field that is in there, then removes it and proves the removal by re-reading the file it produced. ## What it does - Reads EXIF, IPTC, XMP and the PNG, GIF and WebP text chunks most viewers ignore. - Shows every tag found - nothing unrecognised is quietly dropped. - Strip metadata, crop, resize, rotate, redact faces or plates, and convert format. - Choose which groups to keep, if you want to keep any. - Batch several files at once and get a ZIP back. - Nothing is written to disk: the image is processed in memory and streamed straight back. ## How it works 1. Drop in a photo - it is read in your browser's request, not saved. 2. Read the report of everything the file discloses about you. 3. Pick what to remove, redact or resize, and download the clean file. ## What photos actually give away GPS coordinates accurate to a few metres, which on a photo taken at home is your address. The camera or phone's serial number, which links every photo you have ever posted to the same device. A name or copyright string typed into the camera once and forgotten. The editing software and version. On generated images, the full prompt, and on PNGs, text chunks that most metadata viewers never look at. ## Nothing is stored The upload is held in memory, processed and streamed back in the same request. There is no temp file, no cache entry, no database row and no log of the bytes. The one thing you should not have to trust a metadata remover about is whether it kept a copy. ## The removal is verified, not asserted After processing, the file that was produced is read again and the remaining tag count is what the interface reports. Re-encoding an image is exactly what re-injects software tags, so the strip runs last and the proof comes from the output rather than from the intent. ## Blur, pixelate or black box: which to use All three are burned into the pixels before the file is saved, so there is no layer anyone can remove later. Blur uses a radius of a quarter of the box's shorter side (at least 6 px), and Pixelate turns the box into blocks about one twelfth of its shorter side. Both keep rough shapes and colours, which is enough to hide a face, but short text such as a number plate, an account number or a name on a badge can stay guessable, and tools exist that reconstruct pixelated text. For text, use Black box: the area becomes solid black and nothing of the original survives. Redaction runs after the photo is turned upright and before the crop, and you can draw up to 50 boxes per image. ## What the output file can and cannot keep Animated GIF, WebP and PNG files come back as one still image, the first frame. With Output format left on Keep original, GIF, TIFF, HEIC and multi-picture MPO files are saved as JPEG; choose PNG if you need lossless output. JPEG has no transparency, so transparent areas are filled with white. Longest side only ever shrinks an image, never enlarges it. Squeeze under a size searches for the highest JPEG, WebP or AVIF quality that fits, down to a floor of 20; a PNG is lossless, so it is scaled to 85% of its width and height up to six times instead. If the target still cannot be met, the file comes back larger than you asked, so check the size shown after processing. Limits: 25 MB per file, 20 files and 80 MB per batch. ## Questions **Is my photo uploaded to a server?** It is sent with the request and processed in memory, then streamed back. It is never written to disk, cached or logged, and nothing remains once the request ends. **Does removing EXIF reduce image quality?** Stripping metadata itself does not touch the pixels. Converting between formats or resizing does, and those are separate options you choose. **Which formats are supported?** JPEG, PNG, WebP, GIF and TIFF. HEIC and AVIF depend on the optional decoder being installed, and the interface only offers formats this deployment can actually write. **Can I keep the date but remove the location?** Yes. Metadata is grouped and you tick which groups survive. Kept tags are copied across one at a time, so a group you did not tick cannot ride along inside another. **Does it remove the AI prompt from a generated image?** Yes. Generators usually write the prompt into PNG text chunks, which this reads and reports - and which most EXIF viewers miss entirely. **How do I check whether a photo shows where it was taken?** Drop the photo in and read the report before you change anything. If the file holds GPS coordinates, the report says "Exact location recorded", shows the latitude and longitude and offers a "See where this is" link to the spot on OpenStreetMap (the coordinates go to openstreetmap.org only if you click it). Place names such as a city or country written by editing software are listed in the Location group too. No Location group means none of the location fields this tool reads (EXIF GPS, IPTC place names, XMP GPS) is in the file. After you strip it, the output is read again, and "GPS still present" warns you if any location survived. **How do I stop my phone adding the location to photos, and clean the ones I already took?** For new photos, turn it off in the phone (menu names as on an English-language phone). iPhone: Settings > Privacy & Security > Location Services > Camera, then Never. Pixel: open the Camera app, tap Settings, then More settings, and turn off Save location; other Android cameras have a similar location or geotag switch in their own settings. Neither change removes the location from photos already taken. On an iPhone you can also tap Share, then Options, and turn off Location, but only for that one share. For photos you already have, or before sending site photos to a client, drop them here: the default Safe strip (recommended) removes location together with identity, device and timestamps, up to 20 files come back as one ZIP, and each output is read again, so "GPS still present" warns you if any location survived. ## More in Privacy & Security - [Website Security Scan](https://discuvr.org/security-scan/) ## Often used with - [Redact](https://discuvr.org/redact/) - [Sign PDF](https://discuvr.org/sign-pdf/) --- Part of Discuvr (https://discuvr.org/): Discuvr is a collection of free, focused tools for day-to-day professional work - office and data utilities, legal and compliance helpers, privacy and security checks, and developer formatters. Every tool has its own page, and most can also be called from ChatGPT or Claude over MCP.