EXIF Viewer — Extract Image Metadata Online

Read EXIF, GPS, timestamps, UserComment, MakerNote and XMP from JPEG, TIFF, PNG, WebP and HEIC images — entirely in your browser, with flag and hash detection.

EXIF · GPS · XMP

MakerNote hex view

Flag detection

EXIF viewerRead EXIF, GPS, XMP and hidden metadata — private, in your browser

Drop an image here or click to browse

JPEG · TIFF · PNG · WebP · HEIC · RAW (CR2/NEF/DNG/ARW) · Max 20 MB · Read in your browser

Try a sample file

Batch export

Read many images at once and export one CSV or JSON. Up to 100 files, processed locally.

100% Client-Side Processing

Your image is parsed in this browser tab and never uploaded. GPS coordinates, filenames and metadata values are not sent anywhere.

How to use this tool (5 steps)

Drop a JPEG, TIFF, PNG, WebP, HEIC or camera-RAW image (or try a sample below) — or use Batch export for many files
Check the GPS panel, timestamp comparison and any flagged fields in the Overview tab
Open Metadata to read every tag; UserComment and MakerNote show raw bytes as well as decoded text
Turn on Deep scan (CTF mode) to search the raw bytes of UserComment and MakerNote for flags
Use Compare to diff two files, Clean & edit (Pro) to strip or rewrite tags, and export JSON for your writeup or hand the file to the Hex Viewer

Read EXIF Data Without Uploading Your File

Most online EXIF readers send your image to their server. This viewer parses JPEG, TIFF, PNG, WebP, HEIC and TIFF-based RAW files in your browser with a purpose-built parser, so challenge files, private photos and GPS coordinates never leave your device.

Only the metadata-bearing parts of a file are read — for a JPEG, usually the first 64 KB — so even a 20 MB photo opens instantly.

View GPS Coordinates Embedded in Images

When an image contains a GPS block, the tool shows latitude and longitude in decimal degrees and in degrees-minutes-seconds, plus altitude, compass direction and the GPS timestamp when they are present. The Google Maps link is a plain link that opens only when you click it.

Coordinates of exactly 0, 0 are treated as a null value: they are displayed with a warning and no map link is generated.

Detect Hidden Metadata: Timestamps, Camera, Comments

The three EXIF timestamps are compared side by side, so a re-saved or edited image stands out. UserComment is decoded according to its character-code prefix (ASCII, Unicode or unknown) and always shown as raw hex too, because CTF authors often store binary data there.

MakerNote, the camera vendor's private block, is shown as a hex dump with a best-effort decode for Canon, Nikon, Fujifilm and Apple. The hex dump is always the authoritative view. JPEG files may also carry IPTC caption and rights fields, which are listed separately.

What is EXIF Metadata?

EXIF is a set of tags stored in a TIFF-style structure of directories (IFDs). IFD0 holds general image information and points to an Exif IFD (camera settings) and a GPS IFD. In a JPEG the whole structure lives in an APP1 segment that starts with the bytes Exif followed by two zeros; in PNG it is an eXIf chunk and in WebP an EXIF chunk.

Each tag has an ID, a data type (ASCII text, integers, RATIONAL fractions or opaque bytes), a count and a value. This viewer lists all of them with their hex tag ID, name, raw value and decoded value.

Why CTF Players Check Image Metadata

Metadata is usually the first stop in image forensics. Challenge authors hide clues in text fields such as ImageDescription, Artist and UserComment, in custom XMP namespaces, or in the MakerNote; geolocation challenges ask for the place a photo was taken; and a mismatch between the timestamps hints at editing. When there is no EXIF at all, move on to file structure and pixel-level tools.

Supported Image Formats

Format	Where the metadata lives	What is read	Status
JPEG / JPG	APP1 segment starting with "Exif\0\0"; XMP in APP1, Extended XMP in APP2	EXIF, GPS, MakerNote, XMP (standard + extended), thumbnail IFD	Supported
TIFF / TIF	The file itself is the TIFF block (II or MM byte order)	EXIF, GPS, MakerNote, XMP from the XMLPacket tag	Supported
PNG	eXIf chunk; XMP in an iTXt chunk with keyword XML:com.adobe.xmp	EXIF, GPS, MakerNote, XMP	Supported
WebP	RIFF EXIF chunk; XMP in the XMP chunk	EXIF, GPS, MakerNote, XMP	Supported
GIF / BMP	No EXIF support in the format	—	Not applicable
HEIC / HEIF	ISOBMFF container: Exif and XMP are metadata items listed in the meta/iinf and meta/iloc boxes	EXIF, GPS, MakerNote, XMP	Supported (read-only)
Camera RAW (DNG, CR2, NEF, ARW, PEF)	TIFF-based files — parsed as TIFF and labelled by their DNG tag, CR2 header or Make + SubIFDs	EXIF, GPS, MakerNote, XMP	Supported for TIFF-based RAW
IPTC (JPEG APP13)	Photoshop 3.0 segment holding an 8BIM 0x0404 IPTC-IIM block	Caption, keywords, credit, copyright, by-line, location	Supported

How the EXIF viewer works

1. Detect the format from the bytes

The first 12 bytes decide the format — JPEG (FF D8 FF), TIFF (II*\0 or MM\0*), PNG (89 50 4E 47…), WebP (RIFF…WEBP) or HEIC (an ftyp box with a heic/mif1-family brand). TIFF-based RAW files are then labelled by their DNG tag, CR2 header or Make + SubIFDs. The file extension and MIME type are ignored. GIF and BMP get a specific explanation instead of a generic error. HEIC is recognised by its ftyp brand.

2. Locate the metadata segment

JPEG: APP markers are scanned (handling fill bytes, standalone markers and bad lengths) until the image data starts, and every APP1 is checked, not just the first. PNG: chunks are walked until IEND to find eXIf and the XMP iTXt chunk. WebP: RIFF chunks are walked. HEIC: the meta box is read and the Exif and XMP items are located through its iinf and iloc tables. TIFF: the file is the block. JPEG APP13 is also checked for IPTC. Reads are progressive and every block size is capped.

3. Walk the IFDs

The TIFF header gives the byte order and the offset of IFD0. Each 12-byte entry (tag, type, count, value or offset) is decoded, sub-IFDs (Exif, GPS, Interoperability) and the thumbnail IFD are followed, and guards stop circular references, runaway depth (10), oversized entry counts (256) and offsets that point outside the data.

4. Decode the interesting fields

GPS RATIONAL triplets become decimal degrees and DMS, the three timestamps are compared, UserComment is decoded by its 8-byte prefix, MakerNote is decoded best-effort for Canon, Nikon, Fujifilm and Apple, IPTC datasets are decoded from JPEG APP13, and XMP (including multi-segment Extended XMP) is reassembled, pretty-printed and grouped by namespace.

5. Scan for flags and hashes

Decoded text tags, UserComment and XMP values are checked for flag{}, ctf{}, htb{}, picoctf{} and thm{} patterns and for 32/40/64-character hex strings (labelled as possible hashes — algorithm inferred from length only). The optional deep scan also checks readable ASCII, UTF-8 and UTF-16LE runs inside the raw bytes of UserComment and MakerNote.

What the results mean

Result	What it means	What to do
Flags / hashes panel	A decoded text value, UserComment or XMP value matched a flag pattern, or looks like a 32/40/64-character hex hash.	Verify by hand. A hash label is inferred from length only — a 32-character hex string is not necessarily MD5.
GPS panel	Latitude, longitude, altitude and GPS time decoded from the GPS IFD.	Open the map link deliberately. 0,0 is treated as a null value, not a real place.
Timestamp comparison	DateTime, DateTimeOriginal and DateTimeDigitized side by side, with the gap between any that differ.	A discrepancy may mean editing or re-saving, but it is not proof of modification.
UserComment	Free text with an 8-byte encoding prefix (ASCII, UNICODE, JIS or none), shown decoded and as raw hex.	Check the hex when the decoded text looks empty or wrong — binary data is often stored here.
MakerNote	The camera vendor's private block: raw hex dump plus a best-effort field decode for Canon, Nikon and Apple.	Treat decoded fields as hints; the raw bytes are authoritative. Use Deep scan or the Hex Viewer for hidden data.
XMP	The RDF/XML metadata block, pretty-printed and grouped by namespace (dc, xmp, photoshop, custom…).	Look at custom namespaces first — that is where challenge flags usually hide.
IPTC panel	Caption, keywords, by-line, credit, copyright and location fields from a JPEG's Photoshop APP13 segment.	Keywords and captions are free text — they are scanned for flags like any other field.
Compare tab	Every tag that changed between two files, tags only in A, tags only in B, and the count of identical tags.	A changed DateTime or a missing GPS block suggests one copy was re-saved or scrubbed; it does not say which edit tool was used.
Thumbnail IFD	A second metadata directory describing the embedded thumbnail.	Its tags are scanned too; the thumbnail image itself can carry different content than the photo.

Examples

Input: A phone photo with location services on

Result: GPS panel: 48.858844, 2.294350 with DMS, altitude and a map link; timestamps all match.

Meaning: The photo was taken at that location. Open the link to see where — the tool never contacts a map service itself.

Input: A challenge JPEG whose ImageDescription is flag{…}

Result: A Flags panel pinned above the metadata names the field (ImageDescription, 0x010E) and shows the value.

Meaning: The flag was stored as plain text in a standard field that many viewers do not display.

Input: A JPEG with an Acme-brand MakerNote containing ctf{…} in its raw bytes

Result: With Deep scan off nothing is flagged; with it on, a finding appears for MakerNote (raw bytes).

Meaning: The text lives inside opaque vendor data that decoded-field scanning cannot see, which is exactly what Deep scan is for.

Input: A press photo whose IPTC keywords list contains flag{…}

Result: The IPTC panel lists caption, by-line and location; the Flags panel names the keyword field (IPTC 2:25).

Meaning: Keywords are a free-text list that most image viewers never show — a natural place for a challenge author to hide a flag.

Input: The same photo before and after it was sent through a messaging app

Result: Compare shows the GPS, MakerNote and camera tags as 'only in A' and the DateTime as unchanged or missing.

Meaning: The app re-encoded the image and dropped metadata. If a tag you expect is missing in B, it was removed, not edited.

Limitations

Strip and in-place text edits are available for JPEG, PNG and WebP (edits only for tags whose new text fits the existing slot). TIFF/RAW and HEIC are read-only. Your original file is never modified.
Supported: JPEG, TIFF, PNG, WebP, HEIC/HEIF and TIFF-based camera RAW (DNG, CR2, NEF, ARW, PEF). GIF and BMP have no EXIF. RAW formats with their own container (ORF, RW2, CR3, RAF) are not supported.
Files over 20 MB are rejected. TIFF files are read into memory whole (IFDs can sit anywhere), JPEG/PNG/WebP only in the ranges that hold metadata.
MakerNote decoding is best-effort (Canon, Nikon type 3, Fujifilm and a subset of Apple tags). Sony, Olympus, Panasonic, Pentax and Samsung are recognised but shown as hex only; unknown brands show the hex dump only.
IFD traversal stops at depth 10 and 256 entries per IFD; XMP is capped at 1 MB and MakerNote at 2 MB. Longer structures are flagged, not fully shown.
IPTC is read from JPEG APP13 only. For HEIC only the first Exif and XMP item is read, and image grids, derived images and embedded thumbnails are not parsed.
Batch export reads up to 100 files per run and rejects any file over 20 MB; it exports a summary table (format, camera, date, GPS, flag count) as CSV or JSON, not every tag.
EXIF timestamps carry no timezone, so a difference between them is a hint, not proof of tampering.
The flag scan matches flag{}, ctf{}, htb{}, picoctf{} and thm{} plus hex hashes. Encoded or encrypted flags are not decoded. Deep scan only inspects UserComment and MakerNote.
XMP is processed as text, not with an XML parser; malformed XMP is shown raw with a warning.
EXIF stored as a legacy "Raw profile type exif" PNG text chunk (an older ImageMagick convention) is not read.
No EXIF found does not mean nothing is hidden: use the Strings Extractor, the Hex Viewer or pixel-level tools next.

Privacy

Your image is parsed in this browser tab and is not uploaded. GPS coordinates, filenames and metadata values are never sent to a server, and the Google Maps link opens only when you click it. Strip, edit, compare and batch export also run entirely in the browser; your original file is never changed. When you use an Open-in link such as the Hex Viewer, a copy of the file and its findings is saved in IndexedDB in this browser so the next tool can open it without a re-upload. It stays on your device, and the receiving tools only offer it for 30 minutes. If you accept analytics, coarse usage data (file category, extension, MIME type and a size range) may be recorded; file names and contents are not.

Frequently Asked Questions

What is an EXIF viewer?▾

An EXIF viewer reads the metadata embedded inside image files. EXIF (Exchangeable Image File Format) stores information like camera model, capture settings, GPS coordinates, timestamps, and software used — invisible in the image itself but accessible to forensics tools.

Can I view EXIF data without uploading my image?▾

Yes — this EXIF viewer runs entirely in your browser. Your image is never uploaded to a server. All metadata is extracted locally using JavaScript, so your file stays private.

How do I read GPS coordinates from a photo?▾

Load your JPEG, HEIC, PNG, WebP or TIFF image into the EXIF viewer. If the photo was taken with GPS enabled on the camera or phone, the GPS section will show the latitude, longitude, and altitude. The tool converts the raw degrees-minutes-seconds values into decimal coordinates and provides a Google Maps link that opens only when you click it.

What image formats support EXIF metadata?▾

EXIF is most commonly found in JPEG and TIFF files. PNG can embed EXIF in an eXIf chunk (a 2017 addition to the PNG spec). WebP stores EXIF in its RIFF container. HEIC/HEIF (the iPhone default) stores EXIF as a metadata item and is read here too, as are TIFF-based camera RAW files. GIF and BMP do not support EXIF.

Why are there three different DateTime fields in EXIF?▾

EXIF defines three timestamp fields: DateTime (last file modification), DateTimeOriginal (when the shutter was released), and DateTimeDigitized (when the image was digitised, for film scans). In an untampered digital photo, all three are usually identical. If they differ, the image may have been edited or re-saved after capture — but a difference alone is not proof of modification.

What is the MakerNote in EXIF data?▾

MakerNote is a manufacturer-specific binary block that camera brands use to store proprietary settings and metadata not covered by the EXIF standard. The format varies by brand and is often undocumented. CTF challenges occasionally embed data inside MakerNote sections because most EXIF viewers either skip them or show them as gibberish. This tool always shows the raw bytes and adds a best-effort decode for Canon, Nikon (type 3), Fujifilm and Apple files. Sony, Olympus, Panasonic, Pentax and Samsung notes are recognised but shown as hex only.

Is EXIF data always present in images?▾

No. Social media platforms (Instagram, Twitter/X, Facebook) typically strip EXIF metadata when you upload or download images. Screenshots have no EXIF. Images created in Photoshop or GIMP may have reduced metadata. If you find no EXIF in a CTF image, that itself may be a clue — or the metadata may be in a different location (check XMP, or use the Strings Extractor to search for text throughout the file).

Can EXIF metadata contain CTF flags?▾

Yes — this is a common challenge technique. Flag strings can be hidden in fields like ImageDescription, UserComment, Artist, Copyright, or even custom XMP namespace values. This EXIF viewer highlights flag-pattern strings (flag{...}, ctf{...}, htb{...}, picoctf{...}, thm{...}) and common hash formats automatically, and an optional deep scan also checks the raw bytes of UserComment and MakerNote.

Can I remove EXIF and GPS data from a photo?▾

Yes, for JPEG, PNG and WebP. In Pro mode, Clean & edit writes a copy with the EXIF, XMP and IPTC segments removed (plus JPEG comments, or PNG text and timestamp chunks) and leaves the pixels untouched. Your original file is never modified. TIFF/RAW and HEIC are read-only here — use a desktop tool such as ExifTool for those. To hide data in metadata, or for a dedicated scrubber workflow, see the EXIF Data Hider in the Steganography tools.

What is IPTC metadata and does this tool read it?▾

IPTC-IIM is the caption-and-rights metadata used by news and stock photo workflows: headline, caption, keywords, by-line, credit, copyright and location. In a JPEG it sits in a Photoshop APP13 segment. The tool decodes those fields and scans them for flag and hash patterns. IPTC is read from JPEG only; PNG, WebP and TIFF carry the same information as XMP instead.

What is the difference between this viewer and the EXIF Data Extractor?▾

This viewer reads whatever metadata a file already contains — camera, GPS, timestamps, comments, MakerNote, XMP and IPTC — and works on any image. The EXIF Data Extractor in the Steganography tools is built to recover a hidden payload that was written with StegoToolkit's EXIF Data Hider (or a compatible marker), including password-protected ones. If you just want to see what a photo reveals, use this viewer; if you expect an embedded secret message, try the Extractor too.

How can I tell whether two images have the same metadata?▾

Use the Compare tab (CTF and Pro modes): load a second image and the tool lists every tag that changed, plus tags present in only one file — a quick way to spot a re-saved, edited or scrubbed copy of the same photo. Both files stay in your browser.

Related Tools

File Type / Magic Byte Detector

Confirm what a file really is before you look for metadata.

Strings Extractor

No EXIF? Search the whole file for readable text and flags.

Hex Viewer / Editor

Inspect the raw EXIF or MakerNote bytes.

Encoding Auto-Decoder

Decode an encoded UserComment, description or XMP value.

ROT13 & Caesar Cipher Solver

A comment or description that looks like rotated text? Solve the ROT13 / Caesar shift.

PNG Chunk Analyzer

For a PNG, see the chunk structure around the eXIf chunk.

EXIF Data Extractor

Recover a payload hidden in metadata with StegoToolkit's EXIF Data Hider.

EXIF Data Hider

Hide an encrypted message in EXIF or scrub metadata before sharing a photo.