lossless-metadata
Read and strip photo and video metadata (EXIF, GPS, XMP, IPTC, C2PA content credentials, AI-generator tags) without re-encoding. The engine edits the file container and copies the image or video data through byte for byte, so quality never changes. After stripping, it parses the output again from scratch to confirm nothing sensitive is left.
It is the engine behind metadataremoverai.com, which runs it entirely in the browser with no uploads.
| Format | How it is stripped |
|---|
| JPEG | Drops APP1 (EXIF/XMP), APP3–APP15 except APP14 (including APP11 JUMBF/C2PA and APP13 IPTC) and COM. Drops the APP2 ICC profile unless it's kept. A kept orientation or copyright is rebuilt into a minimal EXIF block. |
| PNG | Drops tEXt, iTXt, zTXt, eXIf, tIME and caBX (C2PA) chunks |
| WebP | Drops EXIF/XMP RIFF chunks and fixes the VP8X flags |
| GIF | Drops comment and application extensions, keeps the NETSCAPE loop block |
| TIFF | Rebuilds the IFD; pixel strips never move |
| HEIC / AVIF | Zeroes metadata payloads in place, so iloc offsets stay valid |
| MP4 / MOV | Turns metadata atoms into free padding, streamed rather than loaded whole |
Use
npm install lossless-metadata
import { readMetadata, stripFile, verify, DEFAULT_STRIP_OPTIONS } from 'lossless-metadata';
const report = await readMetadata(file); // tags, GPS, C2PA, AI generator, thumbnail
const result = await stripFile(file, DEFAULT_STRIP_OPTIONS);
const { verification } = await verify(file, result, new Set());
result.blob; // the cleaned file
result.lossless; // true when the pixels were copied through untouched
verification.clean; // false if any sensitive tag survived
verification.pixelsIdentical;
file is a File (or a Blob with a name), so the same code runs in browsers, Web Workers and Node 22+. The options keep the ICC colour profile and EXIF orientation by default, because dropping them can shift colours or rotate the photo. Set keepCopyright: true to keep Artist and Copyright.
Why another EXIF remover
Most tools redraw the image on a canvas and export a new JPEG. That removes the metadata, but it also recompresses the image, can lose the colour profile, and silently drops HEIC, video and C2PA. This engine never decodes the pixels, which is why it can promise byte-identical image data.
ChatGPT and Gemini exports are the case that motivated the verify step. They carry no EXIF at all, only a signed C2PA manifest in a PNG caBX chunk, so tools that count EXIF tags report them as clean when they are not.
Tests
npm test # 154 engine checks, then 143 independent checks
The independent checks need Python with Pillow, plus ffprobe. They confirm with separate tools that forbidden EXIF IDs are gone, that pixels are identical, and that video tags don't leak. The fixtures are generated by test/make-fixtures.py. The two C2PA manifests in test/c2pa/ are real ChatGPT and Gemini manifests spliced onto small test images.
License
MIT
