MetaMarshal
Log inSign up free
On-device by default — runs entirely in your browser

EXIF metadata API for developers

Need metadata handling in your own product? MetaMarshal's developer API exposes the same engine as two endpoints: /metadata to read EXIF, IPTC, XMP, GPS and C2PA signals, and /scrub to return a cleaned file. It's zero-retention — files are processed in memory, batch outputs live behind short-lived signed URLs that auto-delete after an hour, and contents are never logged. Powered by ExifTool, it handles 50+ formats including RAW and video.

Read the API docs →
📷
Drop a photo here
or click anywhere in this box to browse
JPEGPNGHEICWEBPTIFFRAW
🔒 Processed on your device — nothing is uploaded unless you tap the optional AI estimate.
Nothing leaves your device to clean a photo — the only exception is the optional AI location estimate, which sends a downscaled copy off-device, and only after you tap to confirm.

How it works

1
Grab an API key from your developer dashboard and point requests at the /metadata and /scrub endpoints.
2
POST a file to /metadata to get structured JSON — every EXIF, IPTC, XMP, GPS and provenance field.
3
POST to /scrub with a strip profile to receive a cleaned copy, ready to store or hand back to your user.
4
Rely on zero retention: files live in memory only, signed URLs expire in an hour, and just counts and sizes are logged for billing.

Related tools

Check C2PA Content Credentials in a photo
C2PA Content Credentials are a signed provenance manifest that cameras, Adobe and many AI tools embed to record how an i…
Open tool →
View HEIC metadata online
HEIC is the format iPhones save by default, and most EXIF viewers choke on it. MetaMarshal detects HEIC by its actual by…
Open tool →
Remove EXIF but keep copyright info
Photographers face a trade-off: strip metadata for privacy and you also wipe the copyright notice, byline and licensing …
Open tool →

Frequently asked questions

Files are processed in memory and never written to durable storage. Batch outputs are served from short-lived signed URLs that auto-delete after one hour, and file contents are never logged — only counts and sizes, for billing.