ExifCleaner: A Privacy-First Desktop Tool for Stripping Metadata, With Honest Limits

What ExifCleaner Actually Removes and Why That Matters

ExifCleaner is a desktop GUI that strips metadata from a defined set of image, video, and PDF formats. The problem it solves is concrete: every photo taken on a phone or camera embeds GPS coordinates, device serials, timestamps, and software versions. Sharing that file leaks more than the image itself. ExifCleaner gives a non-technical user a drag-and-drop way to wipe that data before publishing. It is not a library or a command-line tool. It is an Electron app with a Perl backend, and the README makes clear the target user is someone who wants privacy without reading ExifTool's manual. The app also handles video containers like MP4 and MOV, which many metadata tools ignore. For journalists, activists, or anyone handling sensitive imagery, this is the audience. The project's own framing is privacy, not forensics: it does not claim to make removal irreversible for every format, and that honesty is rare in this space.

The Mechanism: ExifTool's Stay-Open Protocol and a Verified Allowlist

The core mechanism is ExifTool, a Perl library that reads and writes metadata across dozens of formats. ExifCleaner wraps it in a desktop interface and speeds up batch jobs by using ExifTool's stay-open protocol, which keeps the tool running in memory instead of spawning a new process per file. The README calls this "fast batch processing." The app also enforces a verified allowlist of extensions, which is a deliberate choice. ExifTool can handle far more formats, but the project only accepts the ones it has tested. That list includes common image formats (JPEG, PNG, HEIC, CR2, NEF) and media containers (MP4, MOV, AVI). The allowlist is a contract: if a file type is not listed, the app refuses it at intake. This prevents the false confidence of processing a file ExifTool cannot clean safely. The stay-open protocol is the kind of engineering detail that separates a tool built for real use from a toy script.

Getting It Running: Downloads, Checksums, and the Unsigned Reality

Installation varies by platform. macOS users download a .dmg and must pick the arm64 build for Apple Silicon or the Intel build. Windows offers a portable .exe or an installer, with the portable version recommended. Linux users can grab an AppImage, .deb, or .rpm. Arch Linux users can install from the AUR with `paru -S exifcleaner-bin`. The AppImage needs `chmod +x` after download. The first launch on macOS and Windows will trigger a security warning because the app is not code-signed. The README explains why: signing requires a certificate tied to a legal name, which conflicts with the project's anonymous maintenance. Instead, the project publishes SHA-256 checksums in a SHASUMS256.txt file. You verify with `sha256sum -c SHASUMS256.txt 2>&1 | grep OK`. This is a real tradeoff. The checksum verification is sound, but it assumes the user knows how to run a command. The README also warns to only download from the GitHub releases page, because builds elsewhere are unverified. That is a practical constraint, not a marketing line.

Privacy Features Beyond Simple Stripping

ExifCleaner includes several privacy controls that go beyond a single wipe button. You can preserve orientation, which stops the app from rotating images and altering the visual content. You can save as a copy, leaving the original untouched. You can remove macOS extended attributes (xattr), which often carry their own metadata like download origin. You can preserve timestamps, which matters if you need to keep file modification times for archival purposes. Folder recursion lets you drop a directory and process everything inside. The app also shows a before/after diff for any processed file, so you can inspect exactly what was removed. Dark mode follows the OS preference, and the UI supports 25 languages with in-app switching. The README claims zero telemetry and no network traffic, which aligns with the privacy mission. These features are not unique, but the combination in a free, open-source desktop app is practical.

Known Limitations: Where ExifCleaner Refuses or Cannot Guarantee

The project is upfront about formats it cannot clean reliably. RAF files are refused before writing because ExifCleaner cannot guarantee a safe cleaned artifact. PDFs are processed, but ExifTool writes a reversible update, so the original metadata remains recoverable. The README explicitly says ExifCleaner cannot securely erase PDF metadata. MKV files are rejected at intake because ExifTool does not expose writable Matroska tags. TIFF removal may be partial because some metadata can remain in IFD0, and AVIF has a user-reported partial-removal case under investigation. These are not hidden caveats; they are in a table in the README. This matters for anyone with a mixed library. If you need irreversible removal for PDFs, this is the wrong tool. If you work with TIFF or AVIF, you should test on a copy first. The project's willingness to document these limits is a strength, but it also means the app is not a universal metadata eraser.

Alternatives and the Difference in Approach

The obvious alternative is using ExifTool directly from the command line. ExifTool is a Perl tool with a much broader format catalog and full control over which tags to remove or preserve. The difference is approach: ExifCleaner is a GUI that hides complexity, while ExifTool is a power-user interface that exposes every option. For a one-off cleanup, the CLI is faster if you know the syntax. For a non-technical user or someone processing folders regularly, the GUI saves time and reduces errors. Another alternative is a cloud-based metadata remover, but that requires uploading files to a third party, which defeats the privacy purpose. ExifCleaner runs entirely offline, so your files never leave your machine. The tradeoff is that the GUI is limited to the allowlist, whereas ExifTool can attempt any format it supports. If you need to clean an obscure format, you will have to drop the GUI and learn the CLI.

Maintenance, Licensing, and Upgrade Cost

The project is MIT licensed, so you can use, modify, and redistribute it freely. The repository shows active development: the most recent release, v4.2.1, was pushed in August 2026, and v4.0 marked a major modernization with five new privacy features, metadata inspection, and language switching. The README mentions 265 unit tests and 42 E2E tests, and CI builds and runs the actual artifact before release. Upgrade cost is low for end users: the app has no automatic updates, so you manually download new versions. For developers, the codebase is Perl and Electron, which is an unusual combination, but the MIT license means you can fork and adapt it. The lack of code signing is a recurring maintenance decision, not a bug. You should verify checksums on every release, but that is a one-line command. The project's maintenance appears steady, but the dependency on ExifTool means you inherit its limitations, and the open issues for TIFF and AVIF suggest those problems are not trivial to fix.

Editorial conclusion

Adopt ExifCleaner if you need a free, cross-platform, offline metadata scrubber for photos and videos and you accept the unsigned-build tradeoff. Do not use it for PDFs if you require irreversible removal, and avoid it for MKV files entirely. Before trusting it on sensitive files, verify the SHA-256 checksum from the release page, test on a copy, and check the open issues for TIFF and AVIF before relying on complete removal.

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes