How to Remove EXIF Data from Photos on Windows

Every photo your phone takes records where you were standing when you took it, accurate to a few metres. Removing that before the photo goes anywhere is a one-click job, and it is worth making a habit.

The short answer

1. Open Privacy Scrub in PhotoTray.
2. Drop in a photo, a selection, or a whole folder.
3. See what the files are actually carrying.
4. Choose what to remove: location only, camera details, or everything.
5. Cleaned copies are written where you choose; the originals stay as they are.

Nothing is uploaded, which matters more here than anywhere else on this site — sending a private photo to a website in order to find out what private information it contains rather defeats the exercise.

What is actually in there

Open a photo from a phone and the EXIF block typically holds:

• GPS coordinates — latitude, longitude, and often altitude and compass heading. Accurate enough to identify a specific building.
• Date and time, to the second, including the time zone.
• Camera make and model, and on a real camera, the serial number.
• Lens, aperture, shutter speed, ISO, focal length.
• Orientation — which way up the photo should be displayed.
• Sometimes software used to edit it, and a thumbnail that occasionally still shows a pre-crop version of the image.

The last one surprises people. An embedded thumbnail is generated when the photo is taken and is not always regenerated after editing, so a badly-behaved editor can leave a small copy of the uncropped picture inside a file you thought you had cropped.

Why it matters more than it sounds like it should

The realistic risks are mundane rather than dramatic, which is exactly why they get ignored:

• Selling something online. A listing photo taken in your living room publishes your home address to anyone who cares to look.
• Photos of children. Coordinates of a school, a park, a regular route.
• Working from home. A photo of a whiteboard or a workspace sent to a client carries the location of your house rather than an office.
• Anonymity. Any photo posted under a pseudonym that carries a home location links the two.

None of these require an adversary doing anything clever. The data is in the file and any photo viewer will show it.

What Windows gives you, and where it falls short

Windows does have a built-in option. Right-click a photo, Properties, Details tab, then Remove Properties and Personal Information.

It works, and for one file it is fine. Its limits:

• One file at a time, realistically. Multi-select works but the dialog is awkward and slow over a large selection.
• It is not comprehensive. It removes the fields Windows knows about and leaves others — XMP blocks and maker notes commonly survive.
• No inspection. You cannot see what is there before deciding, so you are removing things blind.
• It edits in place by default in the "create a copy" flow's absence, which is not always what you want.

For a folder of two hundred listing photos, none of that is adequate.

Strip the location, keep the date

The most useful setting is not "remove everything".

The GPS coordinates are the part with a real privacy cost. The date the photo was taken is genuinely useful — it is what your photo library sorts by, and losing it across a whole archive is a self-inflicted problem that is tedious to undo. The camera settings are harmless and occasionally interesting.

So the sensible default for photos you are sharing is: strip the location, keep everything else. Reserve "remove everything" for cases where the camera identity itself matters — journalism, whistleblowing, or simply not wanting a serial number to link two accounts.

The HEIC limitation, stated plainly

This is the one thing you should know before trusting any tool with an iPhone photo.

Removing metadata means rewriting the file without it. PhotoTray can read HEIC — it uses Windows' own imaging component — but it cannot write HEIC, because there is no HEIC encoder in it.

So a HEIC submitted to Privacy Scrub is either scrubbed and saved as a JPG, or declined with an explanation. What it will never do is hand back an unchanged HEIC and report success.

That failure mode — a file that looks cleaned and still carries your coordinates — is the worst thing a privacy tool can do, and it is worth checking that whatever you use does not do it. Convert the photo and check the result.

Make it automatic

The reliable version of this is not remembering. Set a rule: anything that lands in the folder you share from gets its location stripped on arrival.

From then on, the photos you are about to send have already been cleaned, without you thinking about it at the moment you are least likely to think about it.