lossless-metadata

Read and strip photo and video metadata (EXIF, GPS, XMP, IPTC, C2PA content credentials, AI-generator tags) without re-encoding. The engine edits the file container and copies the image or video data through byte for byte, so quality never changes. After stripping, it parses the output again from scratch to confirm nothing sensitive is left.

It is the engine behind metadataremoverai.com, which runs it entirely in the browser with no uploads.

Format	How it is stripped
JPEG	Drops APP1 (EXIF/XMP), APP3–APP15 except APP14 (including APP11 JUMBF/C2PA and APP13 IPTC) and COM. Drops the APP2 ICC profile unless it's kept. A kept orientation or copyright is rebuilt into a minimal EXIF block.
PNG	Drops tEXt, iTXt, zTXt, eXIf, tIME and caBX (C2PA) chunks
WebP	Drops EXIF/XMP RIFF chunks and fixes the VP8X flags
GIF	Drops comment and application extensions, keeps the NETSCAPE loop block
TIFF	Rebuilds the IFD; pixel strips never move
HEIC / AVIF	Zeroes metadata payloads in place, so iloc offsets stay valid
MP4 / MOV	Turns metadata atoms into free padding, streamed rather than loaded whole

Use

npm install lossless-metadata

import { readMetadata, stripFile, verify, DEFAULT_STRIP_OPTIONS } from 'lossless-metadata';

const report = await readMetadata(file);           // tags, GPS, C2PA, AI generator, thumbnail
const result = await stripFile(file, DEFAULT_STRIP_OPTIONS);
const { verification } = await verify(file, result, new Set());

result.blob;                // the cleaned file
result.lossless;            // true when the pixels were copied through untouched
verification.clean;         // false if any sensitive tag survived
verification.pixelsIdentical;

file is a File (or a Blob with a name), so the same code runs in browsers, Web Workers and Node 22+. The options keep the ICC colour profile and EXIF orientation by default, because dropping them can shift colours or rotate the photo. Set keepCopyright: true to keep Artist and Copyright.

Why another EXIF remover

Most tools redraw the image on a canvas and export a new JPEG. That removes the metadata, but it also recompresses the image, can lose the colour profile, and silently drops HEIC, video and C2PA. This engine never decodes the pixels, which is why it can promise byte-identical image data.

ChatGPT and Gemini exports are the case that motivated the verify step. They carry no EXIF at all, only a signed C2PA manifest in a PNG caBX chunk, so tools that count EXIF tags report them as clean when they are not.

Tests

npm test   # 154 engine checks, then 143 independent checks

The independent checks need Python with Pillow, plus ffprobe. They confirm with separate tools that forbidden EXIF IDs are gone, that pixels are identical, and that video tags don't leak. The fixtures are generated by test/make-fixtures.py. The two C2PA manifests in test/c2pa/ are real ChatGPT and Gemini manifests spliced onto small test images.

License

MIT