How to read EXIF metadata, and what it can and cannot prove
EXIF is the block of metadata a camera writes into a photo: the date and time, the device make and model, the camera settings, and sometimes GPS coordinates. You read it with built-in tools on Windows, Mac, iPhone, or Android, or with a free viewer. EXIF is useful context, but it has no cryptographic protection, so any field can be edited or stripped without a trace. Treat it as a lead, not proof.
What is EXIF metadata and what does it store?
EXIF, short for Exchangeable image file format, is a block of metadata embedded inside a JPEG, TIFF, or similar image file. It is a published industry standard maintained by CIPA, the Camera and Imaging Products Association of Japan, under the designation DC-008. The original specification dates to 1995, and the current line is Exif 3.x: version 3.0 arrived in May 2023 with UTF-8 text support, and Exif 3.1 was published on January 30, 2026. EXIF is not a Microsoft or Apple format, and it is not natively defined for PNG.
The standard defines named tags that store, among other fields:
- Capture time: DateTimeOriginal, the moment the shutter fired. This is distinct from the file's modified date, which changes whenever the file is re-saved.
- Device: Make and Model, plus Software, the program that last wrote the file.
- Camera settings: ExposureTime, FNumber (aperture), ISOSpeedRatings, FocalLength, and LensSpecification.
- Location: GPSLatitude and GPSLongitude, present only when location was enabled on the device.
Does EXIF include my GPS location, and why does that matter?
Yes, if location was enabled when you took the photo, EXIF can embed exact GPS coordinates. This is the field with the highest privacy stakes. A geotag can pin a photo to a home, a workplace, or a daily route, and the timestamp can link separate images into a pattern of life.
This is not hypothetical. In December 2012, Vice published an iPhone photo of fugitive John McAfee whose embedded GPS EXIF pinpointed him to Rio Dulce, Guatemala, and he was located shortly after. The lesson for a privacy-conscious user is simple: before you post a photo publicly, check whether it carries a geotag, and remove it if you do not want to reveal where you were. The steps for doing that are below.
How do I read a photo's EXIF data?
Use the tools already on your device. Each method below front-loads where to click.
- Windows 11: right-click the image in File Explorer, choose Properties, and open the Details tab to see the camera, exposure, GPS, and date fields.
- Mac: open the photo in Preview, choose Tools then Show Inspector, and click the info (i) tab for the full EXIF set. Finder's Get Info (Command and I) also exposes capture metadata.
- iPhone or Android: on iPhone, open the photo in Photos and swipe up or tap the info (i) button to see date, camera, and a map if a geotag is present. On Android, open the photo in Google Photos and tap the info (i) button.
- Check on ChronoVerify: upload the photo to the free verifier, which reads the EXIF, summarizes when and on what device the photo was taken, and reports whether the values are internally consistent. ChronoVerify runs the same consistency checks on every image.
For a complete field dump, the de facto open-source tool is ExifTool by Phil Harvey, which reads and writes every documented tag from the command line. For a quick browser read with no install, ChronoVerify's free EXIF and XMP viewer shows the same fields and flags internal inconsistencies.
What can EXIF prove, and what can it not prove?
EXIF describes how a file was made, not whether the depicted event is real. Because it has no signature, every value in it is a claim by the file rather than a verified fact. The table separates what EXIF is good for from what it cannot establish.
| Question | What EXIF can do | What EXIF cannot do |
|---|---|---|
| When was it taken? | Report a claimed DateTimeOriginal you can sanity-check against other signals | Prove the time: the field is editable with free tools and leaves no trace |
| Where was it taken? | Reveal GPS coordinates if a geotag is present | Confirm the location: GPS can be fabricated, and stripping is common |
| What device made it? | List a claimed Make, Model, and Software string | Guarantee the device: those strings can be copied or rewritten |
| Is the file unedited? | Hint at editing software in the Software tag | Detect tampering: EXIF is not cryptographically sealed |
| Did the depicted event happen? | Nothing: EXIF describes the file, not the scene | Confirm an event: it cannot speak to what the image shows |
Two failure modes are worth naming directly. First, a missing EXIF block is not evidence of fakery. Platforms such as Facebook, Instagram, and X strip metadata by re-encoding on upload, and screenshots never carry capture EXIF, so absence is normal. Second, tools like Error Level Analysis do not prove editing. ELA produces false positives from ordinary recompression and is not forensic proof. For a tamper-evident record you need a signed manifest, which is what Content Credentials provide.
How do I remove location data before sharing a photo?
Strip the geotag from the copy you share, and remember that doing so usually leaves the original on your device untouched.
- iPhone: Apple's Personal Safety guide says to tap Share, tap Options, turn off Location, then tap Done. This removes the geotag from the shared copy only, not from the original stored on the device.
- Google Photos: use the Remove geo location sharing setting so location is excluded when you share via link, or remove the location from a photo's info panel.
- Any computer: a metadata tool such as ExifTool can strip GPS, or all EXIF, from a file before you upload it.
One caution: stripping is not the same as deletion. A platform may read and retain your location server-side even while removing it from the public file, so the safest move is to remove the geotag before upload.
EXIF versus C2PA Content Credentials
EXIF tells you a lot but proves nothing, because it is unsigned. C2PA Content Credentials are the cryptographic answer: a provenance manifest sealed with SHA-256 hashes and X.509 certificates, so altering any byte invalidates the signature. The trade-off is durability. Like EXIF, a C2PA manifest is usually destroyed when a platform re-encodes the image, so its absence after sharing is expected and proves nothing on its own. Use both together: EXIF for descriptive breadth, Content Credentials for integrity. To see when each one survives, read when was a photo taken.
Want a plain-language read of a photo's EXIF, capture time, and consistency?
Check a photo nowCommon questions
What does EXIF metadata contain?
EXIF can include the capture date and time (DateTimeOriginal), the device make and model, the software that last saved the file, camera settings such as exposure, aperture, ISO, and focal length, and GPS coordinates when location was enabled on the device.
Does EXIF include my GPS location, and how do I check?
Yes, if location was enabled when the photo was taken. To check, open the photo's properties or info panel and look for GPS latitude and longitude fields. A geotag can pin a photo to a home or workplace, so review it before sharing publicly.
How do I remove location data from a photo before sharing it?
On iPhone, Apple's Personal Safety guide says to tap Share, tap Options, turn off Location, then tap Done, which strips the geotag from the shared copy only, not the original. Google Photos offers a Remove geo location sharing setting. On a computer you can strip EXIF with a metadata tool.
Do Facebook, Instagram, and X strip EXIF when I upload a photo?
Yes. Facebook, Instagram, and X re-encode images on upload, which removes EXIF from the public file. Be aware that a platform may still read and retain your location server-side even after stripping the downloadable copy, so stripping is not the same as deletion.
Can EXIF metadata be faked or edited?
Yes. EXIF has no cryptographic protection, so any field, including the capture time and GPS, can be edited or removed with free tools and leaves no trace. Treat EXIF as a claim by the file, a useful lead but not proof of when or where a photo was taken.
If a photo has no EXIF data, does that mean it is fake or edited?
No. Social platforms and messaging apps routinely strip all metadata by re-encoding on upload, and screenshots never carry capture EXIF. Missing metadata is normal and is not evidence of tampering.
Is ChronoVerify C2PA conformant?
Yes. ChronoVerify is a C2PA Conformant Validator on the C2PA Conforming Products List, record 019f8a20-6452-7a43-b11b-59d0b0e4a84a, covering validation of JPEG, PNG, WebP and AVIF under C2PA specification 2.2. The list is public, so you can check the record yourself. It covers validation rather than generation: ChronoVerify reads and validates Content Credentials, it does not sign them.
Sources and further reading: CIPA Exif standards history at cipa.jp; IPTC on the Exif 3.0 UTF-8 update at iptc.org; Apple's Personal Safety guidance on location metadata at support.apple.com; Google Photos location data help at support.google.com; the C2PA FAQ at opensource.contentauthenticity.org; the 2012 John McAfee metadata case at npr.org; the Library of Congress on platform metadata stripping at blogs.loc.gov.