Dev.to Security 🔐 Cybersecurity 👁 0 📖 1 min read

Strip GPS and EXIF From a Whole Folder of Photos Before You Publish (Local, No Upload)

Every JPEG your phone takes can carry the exact GPS coordinates of where you stood. Post a few "harmless" photos online and you may be broadcasting your home address, your kid's school, your gym. Most people find this ou

Every JPEG your phone takes can carry the exact GPS coordinates of where you stood. Post a few "harmless" photos online and you may be broadcasting your home address, your kid's school, your gym. Most people find this out the hard way.

You don't need a website that "cleans metadata" — you can strip every image in a folder locally in one command. Nothing leaves your machine.

The one-liner (exiftool)

# macOS: brew install exiftool  |  Debian/Ubuntu: sudo apt install libimage-exiftool-perl
exiftool -all= -overwrite_original -r ./photos
  • -all= removes all metadata (GPS, timestamps, camera serial, software).
  • -overwrite_original skips the .jpg_original backups.
  • -r recurses into subfolders.

Verify nothing sensitive remains:

exiftool -gps:all -make -model ./photos

Empty output = clean.

Keep orientation, drop everything else

Stripping -all= can rotate photos that relied on the EXIF orientation flag. Preserve just that one tag:

exiftool -all= --Orientation -overwrite_original -r ./photos

A tiny reusable script

Save as clean-photos.sh:

#!/usr/bin/env bash
set -euo pipefail
target="${1:-.}"
echo "Stripping metadata from images in: $target"
exiftool -all= --Orientation -overwrite_original -r \
  -ext jpg -ext jpeg -ext png -ext webp "$target"
echo "Done. Verifying GPS is gone:"
exiftool -gps:all -r "$target" | grep -i gps || echo "No GPS tags found. ✅"
chmod +x clean-photos.sh
./clean-photos.sh ~/Pictures/to-publish

Why local matters

Uploading photos to an online "EXIF remover" means handing your original, geotagged images — the exact thing you're trying to protect — to a third-party server. Do it locally and the sensitive data never leaves your disk.

If you only have one or two images and don't want to touch a terminal, QuickShrink strips metadata (and compresses) entirely in your browser — the file never uploads. But for a whole folder, the exiftool script above is faster and scriptable.

TL;DR

  • Photos carry GPS. Assume every image does until proven otherwise.
  • exiftool -all= --Orientation -overwrite_original -r ./photos cleans a folder locally.
  • Verify with exiftool -gps:all.
  • Never upload the originals you're trying to protect.
📰 Read the original article on Dev.to Security

Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.