Photos often carry more than pixels. JPEG and PNG files can embed EXIF, XMP, IPTC, GPS coordinates, and C2PA Content Credentials. Uploading that file to a server just to clean it means the metadata already left the browser.
This note is about stripping those fields on the client, before the file is sent anywhere.
What to remove
- EXIF: camera, timestamp, orientation, and GPS
- XMP / IPTC: captions, authors, software, and rights
- C2PA: Content Credentials that can include a provenance chain and embedded thumbnails
Why do it in the browser
A client-side strip reads the file with the File API, drops metadata segments (APP1 for EXIF/XMP, IPTC in APP13, C2PA JUMBF boxes), and rebuilds a new image blob. The original bytes never need to be posted.
If you want a ready-made checker and stripper for remove AI metadata, Remove AI Meta runs that work locally in the browser: EXIF, XMP, IPTC, GPS, and C2PA, with no upload required for the strip itself.
Minimal flow
- Pick an image with an
<input type="file">. - Parse and remove metadata segments in memory.
- Download the cleaned blob.
- Confirm GPS and C2PA are gone before you share the file.
Keep the original if you still need provenance. Strip only the copy you publish.