The EXIF cleaner that never sees your photos — an honest comparison
Search for 'remove EXIF data' and you'll find a dozen tools that all promise the same result: a clean file. The result is the same; the route your photo takes to get there is not. Some tools process the file on their servers, some in your browser, and that difference — upload versus on-device — is the one that matters for a privacy tool, because the whole point of the exercise is controlling who sees the data. Different tools make different trade-offs. Here's an honest map of them, ours included, and how to check any tool's claims yourself.
The trade-off nobody prints on the homepage
An upload-based cleaner is often simpler to build and can lean on heavyweight server tooling. The cost: your original file — GPS pin, timestamps, device serial and all — lands on someone else's machine before it gets cleaned, and you're trusting their retention policy from that moment on. An on-device cleaner never receives the file, so there's no policy to trust; the cost is that everything must run in the browser, which is harder to engineer and historically meant fewer features. Neither model is dishonest. But you should know which one you're using.
The upload-based tools
Jimpl is a popular metadata viewer and remover, and to its credit it's transparent about how it works: at the time of writing, its site states that uploaded files are stored on its servers for up to 24 hours. That's a clear, published policy — but it does mean your photo, metadata intact, sits on a third-party server for up to a day. Metadata2go, another widely used viewer, does not publish a client-side processing claim at the time of writing, so the working assumption has to be that your file is uploaded for analysis. Again: not an accusation, just the trade-off you're accepting when you use it.
The on-device tools
Some tools do keep everything in the browser, and they deserve recognition for it. ExifRemover processes files client-side — genuine on-device stripping — though it stops there: at the time of writing it offers no C2PA verification, no redaction, and no QR-code detection. Redacted.app does client-side redaction well, but it isn't a metadata tool — no metadata viewer, no C2PA, no video support. And Adobe's official verify tool is the reference way to check C2PA Content Credentials, but that's the whole job: it checks provenance and does nothing else. Each of these is a good single-purpose tool. If your task matches the tool, use it happily.
Where MetaMarshal sits
Our trade-off is: everything on-device, even when that made the engineering harder. Reading metadata, stripping it, redacting faces with eye bars, scrubbing GPS from video without re-encoding, detecting QR and barcode leaks in the pixels — which, as far as we know, no other cleaner does — and verifying C2PA signatures cryptographically against the official trust list: all of it runs in your browser, in bulk, for free. The one place a server exists is the developer API, which is a separate product with a separate promise (process in memory, delete on a short TTL). We won't claim to be the best tool — 'best' depends on your task. The claim is narrower and checkable: for this breadth of features, your files never leave your device.
Don't take our word for it
That last claim is the useful kind, because you can verify it in about a minute — for us or for any tool on this page. Open your browser's DevTools, switch to the Network tab, then drop a photo into the cleaner and export the result. If the tool is genuinely on-device, you'll see no request carrying your file: no upload, nothing leaving. Do the same on an upload-based tool and you'll watch the file go. We keep a walkthrough of this check on our /security page precisely because a privacy claim you can't test is just marketing. Run the test on us. That's the honest comparison.