What EXIF actually contains, and what it gives away

Every time the shutter fires, the camera writes a few hundred fields of metadata into the file alongside the pixels. Most photographers know it contains the shutter speed and have a vague sense that it might contain a location. It contains considerably more than that, and the parts nobody looks at are the useful ones.

Where it lives

EXIF is a metadata standard maintained by the Japanese camera industry bodies, and structurally it is a set of TIFF-style tag directories embedded inside the image file. In a JPEG it sits in an application segment near the start. RAW formats, being TIFF derivatives themselves, carry it natively. HEIF carries it too. PNG historically did not, which is why a screenshot of a photograph has none.

The practical consequence of the format is that metadata is a distinct block from the image data. It can be read without decoding the picture, it can be stripped without touching a pixel, and it can be rewritten by anything that opens the file.

What is in there

Identity. Camera make, model, and usually the body's serial number. Firmware version. On most systems, the lens model and often the lens serial number too.

Exposure. Shutter speed, aperture, ISO, exposure compensation, metering mode, exposure program, whether flash fired and in what mode, and the measured brightness value. Focal length as marked, and on many cameras a separate 35mm-equivalent focal length calculated using the body's crop factor.

Time. Date and time the photo was taken, digitised, and last modified — three separate fields that often disagree. Sub-second precision on most modern bodies. Newer cameras also record the timezone offset, which older ones did not, and this is why files from a trip can land in the wrong order after a flight.

Rendering. Orientation, which is why photos sometimes appear rotated in one application and not another. White balance mode and colour temperature. Colour space. The camera's picture style or profile.

GPS, if the camera has a receiver or was paired with a phone. Latitude, longitude, altitude, the satellite timestamp, and sometimes the compass direction the camera was pointing.

Maker notes. This is the interesting part and the least standardised. Every manufacturer reserves a proprietary block and fills it with whatever they like: the focus distance the lens reported, which autofocus point was selected, the internal temperature, battery state, shutter actuation count, lens correction profiles, whether the image was taken with the electronic shutter. The format is undocumented, varies by model, and is sometimes encrypted. Everything genuinely diagnostic tends to live here.

Using it on your own photographs

Diagnosing a soft image is the obvious one, and the metadata usually answers it immediately. Was the shutter speed too low for the focal length? Was the lens wide open, where it is weakest? Was the aperture small enough that diffraction is the explanation? Did the camera focus on a point other than the one you meant — many maker notes record the selected AF point, and a great many "soft lens" complaints turn out to be a camera that focused correctly on the wrong thing.

Auditing your own habits is more useful than it sounds. Sort a few thousand frames by focal length and you find out which lens you actually use, as opposed to which one you believe you use. People buy a lot of zoom range they never touch.

Checking a used purchase, where the file's own record of body, lens, and shutter count can be compared against what the seller said. That is a whole subject in itself, covered in what shutter count tells you when buying a used camera.

Recovering settings from a photograph that worked, when you cannot remember what you did.

The EXIF reader here will show you all of this from a file you drop in. It parses in the browser, so the photo is not uploaded anywhere — which for a format that may contain your home coordinates seems like the right default.

What it gives away

Now the other direction.

Location is the serious one. A camera or phone with GPS enabled records where each photograph was taken to within metres. A set of photographs taken at home, published over time, describes your address precisely. Photographs of children at a school describe the school. This is not hypothetical; it is the single most common privacy failure in photo sharing.

Serial numbers link images to you. Body and lens serials are constant across everything you shoot. Anyone with two of your photographs from different accounts can establish they came from the same camera.

Timestamps describe your routine. A long enough series describes when you are usually out, and when you are usually not.

Different platforms behave differently and you should not assume. Most large social networks re-encode uploads and strip most metadata as a side effect, though this is a consequence of their processing rather than a promise. Photo-sharing sites aimed at photographers often preserve EXIF deliberately, because photographers want to see it. Sending a file directly — email, messaging apps that offer "send as file", cloud links — preserves everything.

Stripping it sensibly

The blunt approach is to remove all metadata, and it is usually the wrong one, because it also removes your copyright and authorship fields, the colour space tag, and the orientation flag.

Better to remove the specific things you care about.

Most RAW processors have this in the export dialog — Lightroom offers to remove location information while keeping copyright, and Capture One and others have equivalents. Both macOS and Windows can strip location from a file's properties without additional software. For batch work or precise control, exiftool is the standard tool and can delete individual tags rather than the lot.

The more robust habit is to not record the location in the first place, if you do not need it. Camera GPS and phone-pairing location tagging are both settings you can turn off, and for most photography the coordinates are of no value to you and of some value to a stranger.

If you do want geotags for your own catalogue, keep them in the originals and strip on export. That is what the export-side option is for.

Two things worth knowing about its reliability

EXIF is trivially editable. Every field, including the camera model, the date, and the GPS coordinates, can be changed with free software in seconds. It is a convenience record, not evidence. Treating a timestamp as proof of anything is a mistake, and this applies equally to a listing that shows you a shutter count.

Editing software loses maker notes. Because the maker note block is proprietary and its internal offsets are fragile, many applications drop or corrupt it when they rewrite a file. This is why a JPEG straight out of the camera will report a shutter count and the same image after a round trip through an editor will not. If you need the metadata intact, work from the original file, and if you are sending a file to someone so they can inspect it, send the untouched one.

A note on what is not EXIF

Two other standards travel in the same files and get lumped in with it. IPTC holds the descriptive and rights fields — caption, keywords, creator, copyright, usage terms — and is what news and stock workflows run on. XMP is Adobe's more modern container, which can hold both of the above plus editing history and develop settings, and which is what a sidecar .xmp file next to a RAW contains.

When someone says "strip the metadata", they usually mean all three. When someone says "keep my copyright info", they mean IPTC. Knowing which is which is the difference between publishing a clean file and publishing an anonymous one.