Skip to content

Engineering

How it works

Most metadata removers decode your image and save it again. That is simple to build, and it quietly costs you quality every time. Here is the alternative.

Updated

The problem with the obvious approach

The easy way to strip metadata in a browser is to draw the image onto a canvas and export it. Three lines of code, and the metadata is gone — because canvas has no idea metadata exists.

It also re-compresses your image. A JPEG exported from canvas has been decoded and re-encoded, typically at 85–95% quality. The pixels are not the pixels you started with. Do it twice and the loss compounds. For a format like HEIC the browser may not even be able to encode it back, so you silently get a JPEG instead.

Container surgery instead

Image formats separate the compressed picture from the metadata around it. If you understand the container, you can remove one without touching the other. That is what this engine does, with a dedicated parser per format:

  • JPEG — walk the marker segments, drop APP1 (EXIF and XMP),APP2 (ICC), APP11 (C2PA), APP13 (IPTC) andCOM, then copy everything from the start-of-scan marker onward verbatim.APP14 is deliberately kept — it declares the colour transform, and removing it breaks CMYK files.
  • PNG — filter out tEXt, iTXt, zTXt,eXIf, tIME and caBX. Surviving chunks are copied with their CRCs intact, so there is nothing to recompute.
  • WebP — drop the EXIF and XMP RIFF chunks, fix the container size, and clear the matching feature bits in the VP8X header. Skipping that last step produces files that strict decoders reject.
  • TIFF — append a rebuilt directory containing only image-critical tags, repoint the header at it, and zero the old one. Pixel strips never move.

When deleting bytes is not an option

HEIC, AVIF, MP4 and MOV share the ISO Base Media container, and it has a property that makes naive editing dangerous: offsets are absolute. A HEIC records exactly where each metadata item sits via an iloc table. An MP4's stco table records where each media chunk begins. Remove bytes from the middle of the file and every one of those numbers becomes wrong.

So we do not remove bytes. We neutralise them in place:

  • HEIC and AVIF — the metadata item payloads are overwritten with zeros. Every offset still resolves, the file stays structurally valid, and the image data is untouched.
  • MP4 and MOV — each metadata box is rewritten as a free box of identical size and zeroed. free is spec-defined padding that every demuxer skips. Header timestamps are zeroed in place.

The cleaned file is therefore the same size as the original. That is the correct outcome, not a failure — the metadata is gone, its former space is now inert padding.

Video without loading video

A browser tab will run out of memory long before it can hold a 2 GB file. So videos are never read whole. Top-level boxes are walked by pulling 16-byte headers throughFile.slice(), only the moov box is read in full — a few hundred kilobytes even in a very long clip — and the output is assembled as a Blob built from lazy references to byte ranges of the original file. Peak memory stays in the low megabytes regardless of duration.

Verification

Claiming a file is clean is easy. Proving it is the interesting part, so after every removal the engine does two things:

  1. Re-parses the output from scratch, as if it were a file you had just dropped in, and lists anything still present. Structural tags such as image dimensions are separated from personal ones, so the count means something.
  2. Compares the pixels. Both files are decoded and every channel of every pixel is compared. If the result says zero pixels changed, that is a measurement, not a slogan. Where a browser cannot decode the format — HEIC often — it says so rather than guessing.

Both results are in the audit report you can download alongside the cleaned file.

Why none of it needs a server

Everything above is byte manipulation. No machine learning, no heavy dependency, no reason to involve a server. Keeping it local removes the upload wait, the file size cap, the queue, and the need for you to trust an operator's retention policy.

It also makes the privacy claim testable rather than promised. Open your browser's Network panel and clean a file: no requests. Install the site and switch off your network: it still works. A tool that uploads your files cannot do that, whatever its privacy page says.