EXIF Data Extractor
Extract hidden messages and files from EXIF metadata. Auto-detect mode scans all fields, manual mode extracts from specific method.
Try the demo instantly
Loads a JPEG with a hidden message already embedded
Drop an image here or click to browse
JPEG, PNG, WebP, TIFF, or HEIC · Max 50 MB
Processed in your browser
Your image is read and analyzed in this browser tab and is not sent to a StegoToolkit server. Basic usage analytics record coarse facts such as the chosen method and a file-size range, never the image or the extracted data. Showing a GPS map is the one exception: if you choose to load it, your browser requests map tiles from OpenStreetMap, which can reveal the area and your IP address (see the notice before it loads).
How to Extract Hidden EXIF Data (5 steps)
- Upload the image that may contain hidden data (JPEG, PNG, WebP, TIFF or HEIC; up to 50 MB).
- Quick mode runs Auto-Detect. Standard lets you pick UserComment or XMP. Forensic mode offers every method and the deniability options.
- Enter the password if the data was encrypted.
- Click Decode. The extracted message or file appears with its detected type.
- Copy the text or download the file. The suspicion scores show which fields look unusual.
EXIF Decoding Methods
| Method | Technique | Auto-Detect and what it needs | Best For |
|---|---|---|---|
| Auto-detect | Tries every method the file's format supports, most suspicious field first, and returns the first that decodes | Yes. Needs this tool's EXIFsteg:v1 header; GPS is accepted only if the 8 bytes read as printable text | Unknown carriers, quick checks |
| UserComment | Reads the UserComment field | In Auto-Detect. Needs the header, then base64 and optional AES-256-GCM | When the Hider used UserComment |
| XMP Namespace | Reads the custom steg: namespace in the XMP packet (and Reed-Solomon parity if present) | In Auto-Detect (not HEIC). Needs the header or namespace, then optional AES-256-GCM | Larger payloads |
| ImageDescription / IPTC Caption | Reads the EXIF ImageDescription or the IPTC-IIM caption (JPEG) | In Auto-Detect (IPTC: JPEG only). Needs the header, then base64 and optional AES-256-GCM | Forensic mode, when you know the method |
| GPS Coordinates | Decodes up to 8 bytes from the latitude and longitude numbers | Special case: in Auto-Detect only when the 8 bytes read as printable text; no marker or length, so it always returns exactly 8 bytes, zero-padded. Choose it by hand for binary data | Forensic mode, tiny values |
| MakerNote / Thumbnail | Reads a vendor-signature MakerNote, or the bytes after the thumbnail's end marker (JPEG) | Both are tried independently by Auto-Detect when the format supports them (Thumbnail: JPEG only). Needs the header, then optional AES-256-GCM | Forensic mode, when you know the method |
What This Extractor Can and Cannot Read
It reads data written by the EXIF Data Hider: a payload stored as base64 behind an EXIFsteg:v1 header, optionally encrypted with AES-256-GCM, in one of seven fields. It does not read hidden data written with another layout, and it is not a general metadata viewer; to see every field in a file use the EXIF / Metadata Viewer. It also cannot find data hidden in the pixels: try the Image Steganography Extractor for that.
The formats are JPEG, PNG, WebP, TIFF and HEIC. IPTC Caption and Thumbnail exist in JPEG only, and XMP is not supported in HEIC.
What Auto-Detect Tries, and What Counts as Success
Auto-Detect lists the methods the file's format supports, sorts them by how suspicious their field looks, and decodes them one by one until one succeeds. A method succeeds when its field holds this tool's EXIFsteg:v1 header (or, for XMP, its steg: namespace) and the data decodes; a wrong password on an encrypted payload fails instead of returning garbage.
GPS Coordinates needs special handling because it has no header and no length. Decoding any real latitude and longitude gives 8 bytes, so Auto-Detect accepts a GPS result only when the 8 bytes read as printable text; a binary GPS payload needs the GPS method chosen by hand in Forensic mode. This is tested: an ordinary geotagged photo reports nothing, a three-character GPS message is still found, and choosing GPS manually still decodes.
Data written with the Hider's deniability option has no header, so Auto-Detect cannot find it by design. Choose the exact method, tick the same deniability option, and give the password if one was set.
How the Suspicion Score Works
Each text field the scan looks at gets a score from 0 to 98. The EXIFsteg:v1 header scores 98. Otherwise points are added for a long base64-looking run (+35), control characters (+25) and a high share of distinct characters in a long value (+20), up to 95. GPS values with an unusual denominator (10000, which this tool's encoding uses) score 50 and very precise values 30. It is a ranking heuristic for deciding where to look, not a probability or a confidence percentage that hidden data exists: a long legitimate description can score highly and a short payload can score zero.
Passwords and Encrypted Payloads
An encrypted payload needs the same password as the Hider. A wrong password and a damaged payload both just fail, and the tool cannot tell you which it was. GPS payloads are never encrypted.
The password is turned into a key with PBKDF2-HMAC-SHA-256 (100,000 iterations) and the salt stored in the payload, and the AES-256-GCM authentication tag then checks it. A wrong password and a damaged payload both simply report failure, so the tool cannot tell you which it was, and there is no way to recover a forgotten password. The full description, including what this scheme does not protect, is on the EXIF Data Hider page.
Examples
Input: A JPEG from the Hider: UserComment, a 40-byte message, no password; Quick mode
Result: Auto-Detect finds the EXIFsteg:v1 header in UserComment and shows the 40 bytes as text with the method named.
Meaning: Quick mode needs no settings when the file was made by this tool's Hider.
Input: An ordinary holiday photo with a GPS location and nothing hidden in it; Quick mode
Result: Nothing is found. The Scrub tab lists the location as a privacy risk; the Extractor does not report it as a secret message.
Meaning: A real location is not a hidden payload; Auto-Detect does not report it as one.
Input: A 3-character message hidden with GPS Coordinates
Result: Auto-Detect finds it (the bytes are printable text) and shows it with 5 zero bytes of padding. Choosing the GPS method manually always works.
Meaning: GPS has no length field, so shorter messages come back padded to 8 bytes.
Input: A file hidden with a password, opened without one
Result: The data is found but not readable; a password prompt appears. A wrong password fails.
Meaning: Finding the field and decrypting it are separate steps.
How the Extractor Works
1. Read the image
The file is parsed in your browser, in a Web Worker, and its metadata fields are collected.
2. Score the fields
Each text field gets a suspicion score; the header scores highest.
3. Try the methods
Auto-Detect decodes each supported method in score order; a chosen method is tried alone.
4. Decrypt and decode
Base64 is decoded, Reed-Solomon parity (XMP) is applied, and a password is used to decrypt.
5. Interpret
The result is shown as text, a file with its detected type, or bytes, with entropy and any CTF-style flags.
What the results mean
| Result | What it means | What to do |
|---|---|---|
| A message or file is shown | A method decoded: the header matched and (if encrypted) the password was right | Copy or download it; the method used is shown |
| Nothing found in any EXIF field | None of the supported methods produced a result | Try Forensic mode with a specific method, the deniability option, or another tool; this does not prove nothing is hidden |
| Needs a password / decryption failed | The payload is encrypted and the password is missing or wrong | Enter the correct password; a damaged payload gives the same failure |
| High suspicion score | The field looks like base64 or binary | A hint to look at that field, not proof of hidden data |
| GPS result padded with zero bytes | GPS Coordinates always returns 8 bytes | Trim the trailing zeros; shorter messages are padded |
Limitations
- Only this tool's layouts are read, and only in the metadata. Data hidden in pixels, in other containers or by other tools is out of scope.
- Deniability-mode data has no header and is never found by Auto-Detect; the exact method and the same switch are required.
- Auto-Detect accepts a GPS result only when it reads as printable text. A binary GPS payload needs the method chosen manually.
- The suspicion score is a heuristic. A high score is not evidence and a low score is not proof of absence.
- Social and messenger apps often re-encode photos and rewrite metadata, so an image that was posted online may have lost its data; we have not tested individual services.
- HEIC and the other formats were tested with the files in this project's test corpus, not with every camera's variants.
Privacy
Your image is read in your browser, in a Web Worker, and is not sent to a StegoToolkit server. The tool saves nothing to disk or to a database: it stores only your display mode (localStorage) and a dismissed-tip flag (sessionStorage), and the image, the extracted data and any password exist only in page and worker memory while you use the tool; starting over or closing the tab discards them. The one deliberate exception is the GPS map: if you click "Load the map from OpenStreetMap", your browser downloads map tiles from openstreetmap.org, which reveals the area (and your IP address) to them, and nothing is requested until you click. Page views are counted by Vercel Analytics, which is cookieless. Tool events (the method you choose; the file's type and a size range; and how long processing took) are sent to Google Analytics only if the site has it configured and you accepted analytics cookies. The tool does not pass the image, the extracted data, a password or the filename to analytics, and a filter drops fields with names such as password, payload, data or filename before anything is sent. If you accept cookies, the site may also load advertising and other analytics scripts that are outside this tool's code. As on any website, the host keeps ordinary request logs for loading the page (IP address, URL, browser); because the file is never uploaded, the image and extracted data are not part of any request.
Which Tool Next?
- EXIF Data Hider — Hide a message so this Extractor can read it, or scrub a photo's metadata
- EXIF / Metadata Viewer — List every metadata field in a file
- Metadata Steganography Extractor — Read hidden data from PNG chunks, PDF fields, GIF comments, MP3 tags and Office properties
- Image Steganography Extractor — Read data hidden in the pixels instead of the metadata
- Steganography Detector — Estimate whether an image shows signs of hidden pixel data
Frequently Asked Questions
How do I know if an image has hidden EXIF data?
Use Quick mode (Auto-Detect). It tries every method the format supports and tells you if one decodes. The suspicion scores point to fields that look like base64 or binary data. Neither is proof: Auto-Detect finds this tool's own format, and data hidden another way will not be found.
Why does Auto-Detect not report my photo's GPS location as a secret?
A GPS location is ordinary metadata. The GPS method of the Hider stores up to 8 bytes in the same numbers, but with no marker. Auto-Detect therefore reports a GPS result only if the 8 bytes read as printable text, so geotagged photos are not flagged. In Forensic mode you can decode the GPS method by hand.
What if decoding fails or returns garbage?
Check the password (a wrong password and a damaged payload both fail), then the method. Data hidden with the deniability option needs the exact method and the same switch. Some fields hold binary data that looks like noise.
Can I decode data hidden by other tools?
No. The Extractor reads this tool's layout. To look at every metadata field in a file, use the EXIF / Metadata Viewer; for pixel data use the Image Steganography Extractor.
Why does it say nothing was found?
Either nothing was hidden with this tool, or the file was re-encoded by an app or service that rewrote its metadata (social and messenger apps often do; we have not tested individual services), or the data uses the deniability option. Try the original file and Forensic mode.
Why is my GPS message padded with zero bytes?
GPS Coordinates stores exactly 8 bytes and has no length field, so a shorter message cannot be told apart from zero padding. Trim the trailing zero bytes.
Is my image uploaded?
No. It is read in your browser. The only network request tied to the file's content is the optional GPS map, which asks OpenStreetMap for tiles after you click and reveals the area (not the image).
Related Tools
EXIF Data Hider
Hide secret messages and files in JPEG, PNG, WebP, TIFF or HEIC metadata, or scrub it. Methods: UserComment, ImageDescription, XMP namespace, IPTC caption, GPS coordinates, MakerNote, thumbnail. Optional AES-256-GCM encryption.
Steganography Detector
Statistical steganalysis with three published tests — chi-square, RS analysis and Sample Pairs — fused into one score and checked against the real StegExpose on a small test set. Payload size estimate. Method fingerprint. WAV audio support. Processed in your browser, not uploaded.