The data hiding in files you send every day

Every file you send carries more than its contents. Some of it is useful, some of it is embarrassing, and a little of it has ended people’s anonymity. None of it is visible when you open the file.

This is not a story about surveillance. It is about defaults: the software that created the file recorded what it knew, and nobody asked it to stop.

What does a photo reveal besides the picture?

A photo from a phone stores an EXIF block. In it: the camera or phone model, the exact date and time, exposure settings, orientation, sometimes the owner’s name, and often the GPS coordinates where the shutter was pressed.

The coordinates are the part that matters. They are precise to a few metres. A photo taken in your living room and posted publicly points at your front door.

Large platforms strip metadata on upload, which has quietly taught people that this is handled for them. It is not handled when you attach a photo to an email, send it in a messaging app that preserves originals, upload it to a small classifieds site, or hand over a file directly.

The famous cases are all the same shape: someone posted a photo they had every right to post, and the coordinates came along.

Digitising old family prints creates the same trap in reverse: the phone photo you take of a print records today’s date and today’s location, not the day the picture was taken. Worth stripping, or at least knowing, before restored copies spread through the family as the record of “when”. The restoration steps themselves are on restore old photos, step by step.

How to check: drop the file into the metadata remover. It reads the file’s marker structure and reports which blocks exist, including whether there is GPS data, before you decide to strip it.

Why is a cropped screenshot not always safe?

Two separate traps.

On some phones, cropping in the gallery app has written the cropped image over the original in the same file without truncating it, leaving what was cut off recoverable with other software. This has leaked more than one redaction.

The second is worse and applies to documents: black rectangles drawn over text in a PDF viewer are drawing, not deletion. The text is still in the file, selectable, copyable, and indexable. Redaction means removing the content, not covering it.

If you need to hide part of an image, crop it in a tool that re-encodes the result, or take a screenshot of the cropped version. If you need to redact a PDF, convert the page to an image first, or use software with a real redaction function.

What do PDFs and Office files carry?

A PDF records the producing application, the creation and modification timestamps, and very often the author’s name, taken from the account name on the machine that made it. A document exported from a word processor frequently carries the template’s original author, who may work at a different company entirely.

Track changes and comments are a related problem: accepted changes usually disappear, but comments and earlier revisions can survive an export.

This is routine in tenders and contract drafts. The previous client’s name in the metadata of a proposal is a real category of embarrassment.

Word, Excel and PowerPoint files store the author, the company, total editing time, and the name of the last person who saved the file. Microsoft Office has a document inspector that removes it; LibreOffice has a security option that strips the same fields on saving. Neither is on by default.

The same shape runs through the rest of the file world:

What helps with PDFs: the PDF tools here drop the producer and creator fields when they write a file, so merging or splitting a document does not add ours and does not carry the old one forward.

When should I check a file before sending it?

You do not need a process for holiday photos. You need one for three situations:

• Anything public. A listing, a forum post, a profile picture, a photo attached to a review. Strip metadata first.
• Anything that leaves the company. A proposal, a report, a contract draft. Check the author fields.
• Anything redacted. Never cover, always remove, then verify by selecting text in the result.

The check takes seconds and the failure is permanent. A file you have sent cannot be recalled.

Why check metadata with a local tool?

There is an obvious irony in uploading a file you are worried about to a website that promises to clean it. The tools here run in your browser precisely because the files people want to inspect are the files they should not be handing over. You can confirm it: open your browser’s network tab, drop in a file, and watch which requests fire: none of them carries your file. The page’s own requests are the cookieless analytics described on the about page.

The PDF tools that drop those fields when they write a file are part of the documents hub, where the site’s browser-only PDF and text tools collect.