Check photo privacy fields before sharing a copy

Choose the exact file you intend to share

Inspect the file from your Downloads or export folder, not an earlier original that will not be sent. The privacy checker reads supported JPEG/PNG/WebP metadata locally. JPEG and WebP inputs may be up to 20 MiB; PNG is limited to 10 MiB and the bounded text limits shown in the tool.

Location, author/contact, device identifiers, prompts and workflow paths are useful categories for review. A label is not a severity score. Unrecognized stored fields can be listed for manual review, and reading warnings remain visible. The scanner does not identify faces, read house numbers in pixels or search for steganography.

Work through a harmless sample first

1. Step 1

   Run the privacy sample

   Open the checker and click Try synthetic privacy sample. Its project-authored PNG contains invented author text, saved parameters, workflow JSON and API-prompt JSON. The findings include author/contact and prompt-related fields; the sample is not evidence that a real creator exposed private data.

   Open the local privacy checker

2. Step 2

   Review a finding's source before its value

   Read the field label, category and Source container/offset/path. If you need the content, check Reveal stored values in this local preview. That control reveals it only in your current browser; it does not turn on report inclusion.

3. Step 3

   Save a report with values omitted

   Leave Include stored values in the report unchecked. Expand Preview JSON report and confirm that stored values are replaced with the omission marker. Download privacy report saves image-privacy-report.json. Labels, source positions and limitations remain; this report does not alter the image.

4. Step 4

   Choose an operation for the fields you found

   For a JPEG where the location-removal policy is appropriate, use the GPS remover. For the synthetic PNG exercise, open the category remover and click Try synthetic PNG sample; it creates the same deterministic stored-text input. Select PNG text, review any other checked categories and the ICC choice, then click Remove selected metadata.

   Remove selected metadata categories locally

5. Step 5

   Inspect the downloaded output

   Click Download cleaned file and load that exact file back into the privacy checker. For the defined PNG sample after all its PNG text is removed, the supported-field scan has no findings. Read coverage and warnings even when the findings list is empty. Your own image may have additional metadata or visible identifying content.

Use a JPEG to see why no GPS is a narrow result

• Download the synthetic GPS JPEG — Project-authored 4 × 3 image and fictional stored fields, fixture v1. It is not a camera capture or a private person's photograph.
• Download no-gps.jpg — A camera EXIF sample with no GPS directory, not a metadata-free image.
• Download cleaned.jpg — The GPS-remover output from the normal synthetic JPEG.

Stop when the reading is incomplete

A malformed container can produce an unreadable result instead of a clean list. A limit failure or unsupported format is not a no-findings result. Compressed PNG text also needs browser decompression support; use a supported current browser rather than treating an unreadable prompt as absent.

Review the picture itself and the sharing destination separately. Removing a caption field does not remove words drawn into the image; removing GPS does not change already published copies. Keep originals privately if they are needed for rights, editing or evidence, and share the verified copy you actually inspected.

Sources and reproducible inputs

• Download the synthetic GPS JPEG — Project-authored 4 × 3 image and fictional stored fields, fixture v1. It is not a camera capture or a private person's photograph.