ExifTool: Read, Edit and Strip Metadata in Almost Any File (GitHub, Scanned)

ExifTool reads and writes the hidden information inside files: EXIF camera settings, GPS coordinates, capture times, IPTC captions and XMP rights data in photos, the maker notes of nearly every camera brand from Canon and Nikon to DJI drones and FLIR thermal cameras, plus metadata in video, audio, PDF, Office documents, fonts and even executables. Its README lists several hundred file types. It is how a fact-checker sees when and with what a photo was taken, how a photographer batch-renames a shoot by date, and how anyone can strip location data before posting a picture.

Phil Harvey has written and maintained it since 2003, and it sits underneath a long list of photo managers, digital asset systems and forensic tools. It is a Perl library plus a command-line application, free under the same terms as Perl itself (the Artistic License or the GPL; GitHub shows GPL-3.0), and it moves fast: version 13.59 landed in May 2026 as a security update, with roughly two releases a month before it.

The canonical home is exiftool.org, not GitHub. The GitHub repository, with about 5,200 stars and 6 contributors, mirrors each release, but downloads, documentation and the forum live on exiftool.org, which also offers a ready-made Windows build (Perl included) and a macOS installer package.

• Repository: github.com/exiftool/exiftool
• Licence: GPL-3.0 (GNU General Public License v3.0)
• Language: Perl. Stars: 5,217. Forks: 495. Last push: May 27, 2026.
• Scan: safe, Oct 28, 2026, commit 2200871

Who it is for

Journalists, fact-checkers and OSINT researchers verifying where and when an image was made, photographers and archivists managing metadata in bulk, privacy-minded people cleaning files before sharing, and developers who need a metadata engine to call from their own code.

Getting started

1. Install on macOS or Linux with a package manager (or take the Windows build or macOS .pkg from exiftool.org)

brew install exiftool

2. Read every tag in a file, with group names

exiftool -a -G1 photo.jpg

3. Remove all metadata before sharing (keeps a photo.jpg_original backup)

exiftool -all= photo.jpg

4. Or run it straight from a clone of the repository, no install needed

git clone https://github.com/exiftool/exiftool.git && cd exiftool && ./exiftool t/images/ExifTool.jpg

Package managers can lag a few releases behind exiftool.org (Homebrew was on 13.55, the latest production release, when we checked). ExifTool parses untrusted files, and an old version had a serious bug in its DjVu parser, so keep it current if you run it on files from strangers or on a server.

Safety scan

We cloned exiftool/exiftool at commit 2200871 on Oct 28, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets, no pattern hits, no install hooks and no workflows across 1,259 files. The network hosts are the specifications and namespaces the code cites (IPTC, Adobe, Apple, Creative Commons, exiftool.org's own XMP namespaces) and geonames.org for the optional location database.
• The 11 committed binaries are all in t/images, the test suite's sample files, and none is over 10 KB. Six are stub executables (a Windows PE built with Cygwin, a 32-bit Linux ELF, a 64-bit Linux shared object, a PowerPC Mach-O executable, an x86-64 Mach-O dylib and a static library archive) that exist so the tests can check ExifTool reads executable headers. The rest are a Windows shortcut pointing at exiftool(-k).exe on the author's own desktop, an AppleDouble macOS resource file, and tiny FLIF, JPEG XL and WordPerfect Graphics images. ExifTool reads them; it never runs them.
• No dependency lockfile to check: ExifTool is pure Perl with no required modules beyond a standard Perl install, and the optional ones (compression and Windows file-name support) come from your own Perl.
• Scorecard rates it 1.2 because the GitHub repository is a release mirror with no CI, branch protection, security policy or signed releases. That reflects where development happens rather than how it is done; the full change history is on exiftool.org and in the Changes file.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: HTML 287.1K, JSON 75, CSS 64, YAML 43.

Questions

Is ExifTool free?

Yes. ExifTool is free software, distributed under the same licence as Perl, and free for personal and commercial use. The Windows executable and the macOS package on exiftool.org are free too, and there is no paid version.

Can ExifTool tell me where a photo was taken?

Only if the file still carries that information. Phones and many cameras write GPS coordinates into the EXIF data, and ExifTool shows them as GPSLatitude and GPSLongitude, but most social networks and messaging apps strip metadata on upload, and anyone can edit it. Treat metadata as one piece of evidence to check against others, and think twice before publishing a private person's location.

How do I remove metadata from a photo with ExifTool?

Run exiftool -all= on the file. It writes a clean copy and keeps the original with _original added to the name; add -overwrite_original to skip the backup. To keep the colour profile, use exiftool -all= --icc_profile:all. Do not strip proprietary RAW files this way, since their maker notes are needed to process them.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.