szTheory/exifcleaner

Desktop app to clean metadata from supported images, media files, and PDFs.

• Fast batch processing via ExifTool's stay-open protocol
• Drag and drop files or folders
• Free and open source (MIT)
• Cross-platform: macOS, Windows, and Linux
• Supports a verified allowlist of image, media, and PDF formats (full list below)
• Privacy controls: preserve orientation, save as copy, remove macOS extended attributes, preserve timestamps
• Folder recursion — drop a folder to process all files inside
• Metadata inspection — expand any file to see before/after diff
• Dark mode (follows OS preference)
• 25 languages with in-app language switching
• No automatic updates or network traffic — zero telemetry, zero phone-home
• Every release verified by CI against the actual installed app on macOS, Windows, and Linux

ExifCleaner v4.0 is a complete modernization — the first release since v3.6.0 (May 2021). Highlights:

• 5 new privacy features: preserve orientation, save as copy, xattr removal, preserve timestamps, folder recursion
• Metadata inspection: expand any processed file to see exactly what was removed
• Language switching: change language from settings without restarting (25 locales)
• Security hardened: CSP, Electron Fuses, IPC validation, navigation hardening, permission gates
• Native Apple Silicon and Intel builds: separate downloads, no Rosetta needed
• 265 unit tests + 42 E2E tests: comprehensive quality gates

See the CHANGELOG for the full list of changes.

macOS 12+, Windows 10+, and Linux are supported (64-bit).

• macOS: Download the .dmg file — pick the arm64 build for Apple Silicon, the other for Intel
• Windows: Download ExifCleaner.<version>.portable.exe (recommended) or ExifCleaner.Setup.<version>.exe (installer)
• Linux: Download the .AppImage, .deb, or .rpm file

For Linux, the AppImage needs to be made executable after download.

Your OS will warn you the first time you open it. ExifCleaner is not code-signed — see Opening unsigned builds for the one-time steps, and why.

Arch Linux users can install from the AUR:

paru -S exifcleaner-bin

ExifCleaner is not code-signed. On first launch your OS will warn you. This is expected, it is a one-time step, and it does not mean the download is unsafe — verify the checksum below if you want certainty.

macOS

• macOS 14 (Sonoma) and earlier: right-click (or Control-click) the app → Open → click Open in the dialog.
• macOS 15 (Sequoia) and later: right-click → Open no longer works. Double-click the app once and let it be blocked, then go to System Settings → Privacy & Security, scroll down, and click Open Anyway next to the ExifCleaner message.

Windows

Windows Defender SmartScreen shows "Windows protected your PC". Click More info → Run anyway.

Linux

No gatekeeping. The AppImage just needs chmod +x (above). .deb and .rpm install normally.

Signing macOS builds requires an Apple Developer certificate at $99/year, and the certificate embeds the holder's legal name, which macOS then displays in the Gatekeeper dialog. Windows requires a separate EV certificate at $200–600/year tied to a verified legal identity. For a privacy tool maintained anonymously, that tradeoff isn't one this project is willing to make.

What you get instead:

• Published SHA-256 checksums for every artifact (below) — verifies the download is byte-for-byte what CI built.
• Every release is built in public by GitHub Actions from tagged source you can read, not on anyone's laptop.
• CI installs and runs the actual artifact before it can be released — it mounts the DMG, installs it, launches it, and strips metadata from a test image. A build that doesn't work never reaches the release page.

Only download from the GitHub releases page. Builds shared through other channels are not ours and are not verified.

Each release includes a SHASUMS256.txt file. Download it from the release page and verify your download:

sha256sum -c SHASUMS256.txt 2>&1 | grep OK

• Official Website
• Download
• Source Code
• Issue Tracker
• Engineering guide
• Contributing and translations

ExifCleaner accepts only the formats below. This is the app's tested intake contract, not ExifTool's much broader reader/writer catalog.

• Images: .jpg, .jpeg, .png, .gif, .tiff, .tif, .webp, .heic, .heif, .bmp, .avif, .svg, .cr2, .cr3, .nef, .arw, .orf, .rw2, .raf, .dng, .pef, .srw
• Media: .mp4, .mov, .avi, .m4a, .m4v, .3gp, .wmv
• Documents: .pdf

ExifCleaner relies on ExifTool's writer support. Some formats impose structural limits that prevent ExifCleaner from making an irreversible-removal guarantee:

The PDF behavior is documented in the ExifTool application documentation, and ExifTool's Matroska tag table marks the container's extracted tags as non-writable. TIFF and AVIF remain open because their reported behavior may still be addressable without introducing a separate file-format engine.

ExifCleaner has the same writer limitations as the underlying exiftool it depends on. Taken from the official website:

• ExifTool will not rewrite a file if it detects a significant problem with the file format.
• ExifTool has been tested with a wide range of different images, but since it is not possible to test it with every known image type, there is the possibility that it will corrupt some files. Be sure to keep backups of your files.
• Even though ExifTool does some validation of the information written, it is still possible to write illegal values which may cause problems when reading the images with other software. So take care to validate the information you are writing.
• ExifTool is not guaranteed to remove metadata completely from a file when attempting to delete all metadata. For JPEG images, all APP segments (except Adobe APP14, which is not removed by default) and trailers are removed which effectively removes all metadata, but for other formats the results are less complete:
  • JPEG - APP segments (except Adobe APP14) and trailers are removed.
  • TIFF - XMP, IPTC, ICC_Profile and the ExifIFD are removed, but some EXIF may remain in IFD0. (The CommonIFD0 Shortcut tag is provided to simplify removal of common metadata tags from IFD0.)
  • PNG - Only XMP, EXIF, ICC_Profile and native PNG textual data chunks are removed.
  • PDF - The original metadata is never actually removed.
  • PS - Only XMP and some native PostScript tags may be deleted.
  • MOV/MP4 - Most top-level metadata is removed.
  • RAW formats - It is not recommended to remove all metadata from RAW images because this will likely remove some proprietary information that is necessary for proper rendering of the image.

New translations and corrections are welcome. See Contributing for the small-string workflow. Current translation status:

• Arabic by @zefr0x
• Catalan by @marcarmengou
• Chinese (Mandarin) by MarcusPierce
• Croatian by @milotype
• Czech by @tomz00
• Danish by @zlatco
• Dutch by @rvl-code
• French by @NathanBnm
• German by @tayfuuun, @philippsandhaus
• Hungarian by @icetee
• Italian by @PolpOnline
• Japanese by @AKKED
• Malayalam by @theunknownKiran
• Persian by @RamtinA
• Polish by @m1chu
• Portuguese (Brazil) by @iraamaro, @dadodollabela
• Russian by @likhner
• Slovak by @LiJu09
• Spanish by @ff-ss
• Swedish by @sastofficial
• Turkish by @bsonmez
• Ukrainian by @hugonote
• Vietnamese by @tensingnightco

Built with Electron, React 19, and TypeScript in strict mode. A hand-rolled ExifTool adapter uses the -stay_open protocol for fast batch processing. The engineering guide explains the architecture and traces a file end to end.

git clone https://github.com/szTheory/exifcleaner.git
cd exifcleaner
yarn install

Pull down the latest ExifTool binaries (requires Perl, macOS/Linux only):

yarn run update-exiftool

Launch the app with Hot Module Reload:

yarn dev

yarn test          # Unit tests (Vitest, ~1.4s)
yarn test:e2e      # E2E tests (Playwright, ~30s) — requires yarn compile first
yarn lint          # Prettier formatting check
yarn typecheck     # TypeScript strict mode check

Edit .resources/locales/<locale>.json, then run yarn i18n:write and yarn i18n:check. See CONTRIBUTING.md for placeholder, review, and testing guidance.

Releases are built by GitHub Actions. To publish:

1. Run yarn verify:release. If it reports known-gap release blockers, fix or remove the blocking marker before publishing; if it reports release-note drift, run yarn known-gaps:write and review the managed block.
2. Make sure RELEASE_NOTES.md is current — it becomes the release body verbatim
3. Trigger the Release workflow via workflow_dispatch in the GitHub Actions UI
4. CI builds all platforms unsigned, then installs and smoke-tests one representative artifact per platform — mounts the Apple Silicon DMG / runs the NSIS installer / extracts the AppImage, launches the installed binary, and strips metadata from a test image. macOS additionally runs the Gatekeeper regression gate. The remaining four binaries receive exact-inventory, non-empty, and format-structure checks. A build that fails any of these cannot reach the release page.
5. A draft GitHub release is created with all artifacts and SHASUMS256.txt
6. Download the DMG through a browser and confirm it opens (this is the one check CI cannot do — neither codesign nor spctl can tell "shows a dialog you click through" from "launches cleanly")
7. Review the draft and publish when ready

Thanks to all the people who submitted bug reports, fixes, and translations. If I've missed you, let me know and I'll add you.

• @m1chu - Polish translation, Mac dock bug fix, Unicode filename debugging
• @LukasThyWalls - Unicode filename debugging, feature suggestions
• @AKKED - Japanese translation, Unicode filename debugging
• @TomasGutierrez0 - ExifTool dependency audit
• @5a384507-18ce-417c-bb55-d4dfcc8883fe - Linux version debugging
• @totoroot - Linux AppImage debugging, usability feedback, feature suggestions
• @Scopuli - Linux AppImage debugging
• @Tox86 - Settings menu bug report
• @ff-ss - Spanish translation
• @tayfuuun - German translation
• @philippsandhaus - German translation fixes
• @airvue - Ubuntu .deb debugging
• @Goblin80 - Ubuntu .deb debugging
• @zahroc - Bulk directory error diagnosis
• @iraamaro - Portuguese (Brazil) translation, Debian/Slackware build fix
• @LiJu09 - Slovak translation
• @likhner - Russian translation
• @hugonote - Ukrainian translation
• @dadodollabela - Portuguese (Brazil) translation fixes
• @zlatco - Danish translation
• @zefr0x - Arabic translation
• @rvl-code - Dutch translation
• @PolpOnline - Italian translation, Arch Linux distribution
• @NathanBnm - French translation
• @Dyrimon - Linux AppImage exit fix
• @MarcusPierce - Chinese (Mandarin) translation
• @brandonlou - CVE-2021-22204 notification
• @v4k0nd - Checksum verification instructions
• @papb - Windows portable build
• @Bellisario - Windows portable build
• @overjt - XSS and Electron reverse shell vulnerability PoC
• @bsonmez - Turkish translation
• @milotype - Croatian translation
• @icetee - Hungarian translation
• @sastofficial - Swedish translation
• @theunknownKiran - Malayalam translation
• @tomz00 - Czech translation
• @tensingnightco - Vietnamese translation
• @marcarmengou - Catalan translation
• @RamtinA - Persian translation