Cleaning photo metadata on a device you don't control

It is worth being precise about why this is a separate problem, because the two get conflated constantly. When a browser tool does its work locally, it means the image data is handled by code running on the machine in front of you rather than being handed to a website. That is a real and checkable property — the procedure for testing it is set out in how to tell if a browser tool really processes your photo locally. But "the website never receives the file" and "nobody will ever know I had this file" are entirely different claims, and only the first one is about the tool. The second is about the computer. If the computer is not yours, local processing has protected you from a stranger on the internet while leaving you fully exposed to the person who administers the device.

What the machine keeps that the website never sees

The file itself, twice over. To clean a photo on a borrowed computer you first have to get the photo onto it — emailed to yourself, pulled out of a chat app, copied off a phone, downloaded from cloud storage. That original is now a file on that machine. Then the cleaned version is saved, usually to the same downloads folder. You arrived with a privacy problem in one file and left two copies of it behind, and the second one has the original picture in it even though the tags are gone.

Cached previews that outlive the file. Operating systems render small previews of images so folders display quickly, and they keep those renderings so they do not have to redo the work. Microsoft's own developer documentation describes Windows checking a thumbnail cache before calling the thumbnail extractor, and storing cached images at a set of fixed sizes independent of the source file. The practical consequence is blunt: a recognisable miniature of your photo can persist in a system cache after you have deleted the file, and no file-level cleanup touches it. Other platforms keep comparable caches; the details vary by system and version, so treat this as a category of risk to expect rather than a specific path to go hunting for.

Lists that record the name even when the file is gone. The browser's download list, the operating system's recent-files list, the search index, and an application's "open recent" menu all store filenames and paths. Filenames are not a footnote here — they routinely carry dates, locations, camera sequence numbers and subject names, which is the whole subject of what your filename and file dates reveal after you strip metadata. On a shared machine, a filename sitting in a recent list is readable by the next person who sits down, without them going looking for anything.

Backup and sync agents that act on their own schedule. A managed computer frequently has something copying folders to an organisational cloud account in the background. Microsoft documents its Known Folder Move feature as redirecting and backing up the Desktop, Documents, Pictures, Screenshots and Camera Roll folders — the Downloads folder is not in that published list, but that is a narrow fact about one feature's defaults, not a guarantee. Administrators can configure other tools and policies, other platforms draw the line elsewhere, and the folder you happen to save into may well be one that is being watched. The important part is the timing: a sync agent can copy a file within seconds of it appearing, so deleting it a minute later does not necessarily win the race.

Software whose job is to observe. Corporate and institutional devices may run endpoint monitoring, data-loss-prevention tooling, or managed browser policies, and public terminals sometimes run session-logging or session-recording software. What any specific deployment records — file writes, screenshots, browser activity, removable media use — depends entirely on the product and how it was configured, and you generally cannot tell from the outside. That uncertainty is itself the finding. If you cannot establish what a device logs, plan on the assumption that it logs something.

A signed-in browser profile. If the browser is signed into an account, history and sometimes other data can synchronise to that account's other devices. On a shared computer, that account may not be yours; on a work computer, the account may be administered. Either way the record of what you did can travel off the machine without any file doing so.

Sorting the device you are actually on

Not every borrowed machine carries the same risk, and treating them all as equally dangerous leads people to give up on cleaning entirely. A rough ordering helps.

1. A device you own but do not administer — your own phone or laptop that has a work profile or school management on it. Usually the mildest case, and often the management applies only to the managed profile. Doing personal work in the personal side of the device is a reasonable position, while doing it inside the managed profile is not.
2. A household or family computer with separate accounts. The account boundary does genuine work here. Your downloads folder, recent files and browser profile are your own. The remaining risks are the shared administrator account, anything on shared storage, and the backup that covers the whole machine.
3. A shared computer with one account everybody uses. There is no boundary at all. Every file you save, every download-list entry and every cached preview is directly visible to the next person, and that next person is frequently exactly the person the photo was sensitive to.
4. A managed work or institutional device. The administrator has, by design, capabilities you do not. This is the case where you should assume observation rather than argue yourself out of it, because that assumption is usually correct and the cost of acting on it is small.
5. A public terminal — library, hotel, internet café, conference kiosk. Unknown configuration, unknown software, unknown previous user, and often no ability to install or delete anything. Some public machines reset themselves on reboot and some do not, and you have no way to tell which from the chair.

A workflow that limits what you leave behind

1. Ask whether the job can wait. Most metadata cleaning is not urgent. If the same photo can be handled on your own phone in two hours, that is a better plan than any amount of cleanup on a machine you do not control.
2. Prefer your phone to a borrowed computer. A personal phone, even an old one, is usually the most private device an individual has. The browser tool on this site works in a mobile browser, so a phone is generally the right instrument rather than a compromise.
3. Keep the file off the internal drive. If you must use the machine, work from removable media where you can: open the original from the drive, save the cleaned copy back to the drive, and leave with it. Your browser may need its download location changed for this, and some managed devices block removable media outright — if yours does, you are back to step one.
4. Do not route the file through an account on that machine. Emailing the photo to yourself and opening it in a signed-in mail client leaves the message, the attachment cache and the session behind. If you must transfer the file, a direct cable or card transfer leaves less than an account login does.
5. Clean promptly, then clean up promptly. The window between the file appearing and a sync agent noticing is short. Do the work in one sitting rather than leaving the original sitting in downloads while you do something else.
6. Delete both copies and empty the bin. Deleting to the recycle bin or trash is not deleting. Empty it, and check the downloads folder rather than trusting the browser's list.
7. Close the session properly. Sign out of any account you signed into, close the browser rather than just the tab, and if the machine has a guest or kiosk mode that discards state on exit, use it deliberately rather than hoping it exists.
8. Accept the residue you cannot reach. You will not be able to clear a thumbnail cache, a search index, or a monitoring log on a device you do not administer. Decide in advance whether the photo is one you can live with leaving a shadow of, and if it is not, do not open it there.

Where this site's tool fits is narrow and worth stating plainly. MetadataWipe takes a single JPEG or PNG you pick from the device you are using, runs a quick heuristic scan of roughly the first half-megabyte of the file for EXIF, GPS and PNG metadata markers, redraws the image onto a canvas to produce a metadata-free copy, and hands it back with -metadatawipe added to the filename. The download is generated from data held in the browser on that machine, not fetched from a server — the page contains no network calls for your image at all. That is exactly why it is usable on a borrowed computer in the first place, and exactly why it cannot help with the rest: it has no reach into the filesystem, the recycle bin, the thumbnail cache, a sync agent or a monitoring tool. It handles one file at a time, does not process HEIC or video, and its scan is a quick screen rather than a forensic audit.

Common mistakes and misconceptions

"It's a browser tool, so nothing is stored anywhere." Nothing is stored on a server. The cleaned file you downloaded is stored on the computer you downloaded it to, because that is what downloading means. The two statements are compatible and people routinely hear only the first.

"Incognito mode covers it." A private window affects the browser's own history and site data for that session. Files you save are ordinary files, and everything outside the browser — caches, indexes, sync agents, monitoring software — is unaffected.

"It's my work laptop, so it's basically mine." Long-term custody is not control. The distinguishing feature of a managed device is that someone else has administrative capabilities on it, and that stays true however familiar the machine feels.

"I'll just delete it afterwards." Deletion removes the copy you know about. It does not address the recycle bin, cached previews, list entries, or anything a background process already copied elsewhere — and the copy may have moved before you deleted it.

"Cleaning it on the shared computer is better than not cleaning it." Sometimes, but not always. If the person you are protecting the photo from is a member of the household that shares the computer, cleaning the file there moves the exposure closer to them rather than further away. Match the device to the threat, not to convenience.

"A public machine resets when it restarts." Some do. Many do not, and the ones that do often restore only certain parts of the system. There is no way to verify this from the keyboard, so it is not something to rely on.

Related guides

See also:

• How to tell if a browser tool really processes your photo locally
• What your filename and file dates reveal after you strip metadata