EXIF Data Explained
EXIF is the block of technical data your camera writes inside the photo file the moment you press the shutter. This page is the reference: what every field means, where it physically lives in the file, which apps read it and which quietly delete it, and what it can give away about you.
EXIF in one paragraph
EXIF stands for Exchangeable Image File Format. It is a metadata standard — maintained today by Japan's CIPA and JEITA — that defines a set of named fields, called tags, and where to put them inside an image file. A typical phone photo carries somewhere between thirty and a few hundred of them. They record the device (make, model, serial number), the exposure (shutter, aperture, ISO, focal length), the time (to the second, sometimes with timezone), the place (GPS latitude, longitude, altitude, compass bearing), and the image structure (orientation, colour space, embedded thumbnail). The data is invisible when you look at the photo and travels with the file wherever you send it.
Jump to the full field glossary, how cameras write it, which apps read vs strip it, or the privacy risks. Or open a photo in the viewer and read along with your own file.
What Every EXIF Field Means
EXIF tags are not one flat list. They live in separate directories inside the file — IFD0 for the main image, an Exif sub-directory for camera settings, a GPS directory, and IFD1 for the thumbnail. The tables below follow that structure, because it is the same grouping ExifTool and most viewers use, and it explains why two similar fields (DateTime and DateTimeOriginal) can disagree. Tag IDs are given in hex, as they appear in the standard.
IFD0 — the main image directory
Inherited from TIFF. These describe the file and its provenance rather than the exposure.
| Field | Tag | What it means | Example |
|---|---|---|---|
| Make | 0x010F | Manufacturer of the device that captured the image. | Apple |
| Model | 0x0110 | The specific body or phone model. | iPhone 15 Pro |
| Orientation | 0x0112 | How the camera was held, as a value from 1 to 8. Viewers rotate the pixels on display rather than the file rotating itself — which is why a photo can look upright on your phone and sideways on a website that ignores the flag. | 6 (rotate 90° CW) |
| XResolution / YResolution | 0x011A / 0x011B | Print density, paired with ResolutionUnit. It says nothing about how detailed the image is — a 72 here does not mean a low-quality photo. | 72, inches |
| Software | 0x0131 | Firmware version, or the last application to write the file. | 17.4.1 |
| DateTime | 0x0132 | When the file was last changed — ExifTool calls it ModifyDate. Cameras set it equal to capture time; editors bump it on save. If it is later than DateTimeOriginal, the photo has been re-saved. | 2024:03:15 14:23:01 |
| Artist / Copyright | 0x013B / 0x8298 | Photographer name and rights string. Set in the camera menu, so they persist across every shot until changed. | Jane Doe |
| HostComputer | 0x013C | The machine that processed the image. Apple writes the phone model here as well as in Model. | iPhone 15 Pro |
Exif SubIFD — time and exposure
The heart of EXIF. Everything the camera knew about the shot at the instant it fired. Our guide to camera settings in EXIF covers how to read these as photography rather than as data.
| Field | Tag | What it means | Example |
|---|---|---|---|
| DateTimeOriginal | 0x9003 | The second the shutter fired. This is the field that means "when was this photo taken" — and the one editors leave alone. | 2024:03:15 14:23:01 |
| DateTimeDigitized | 0x9004 | When the image was digitised. Identical to the above on a digital camera; on a scan of a negative it is the scan date. | 2024:03:15 14:23:01 |
| OffsetTimeOriginal | 0x9011 | Timezone offset for the capture time. Added in EXIF 2.31 (2016) — before that, EXIF timestamps had no timezone at all, which is why old photos are ambiguous by up to a day. | -05:00 |
| SubSecTimeOriginal | 0x9291 | Fractional seconds. Useful for ordering burst frames that share the same second. | 742 |
| ExposureTime | 0x829A | Shutter speed in seconds, stored as a fraction. | 1/125 |
| FNumber | 0x829D | Aperture as an f-stop. Smaller number, wider opening, more light. | f/1.8 |
| PhotographicSensitivity | 0x8827 | Sensor sensitivity. Called ISOSpeedRatings before EXIF 2.3 renamed it; most viewers still label it ISO. | 200 |
| ExposureProgram | 0x8822 | Which mode the dial was on, as an integer: 1 manual, 2 program, 3 aperture priority, 4 shutter priority. | 2 (program) |
| ExposureBiasValue | 0x9204 | Exposure compensation the photographer dialled in, in stops. | -0.3 EV |
| MeteringMode | 0x9207 | How the camera measured light: 2 centre-weighted, 3 spot, 5 pattern/matrix. | 5 (pattern) |
| Flash | 0x9209 | A bitfield, not a yes/no. The lowest bit says whether the flash fired; the rest record whether it was forced, suppressed, or whether return light was detected. | 16 (off, did not fire) |
| FocalLength | 0x920A | Actual focal length of the lens, in millimetres. | 6.9 mm |
| FocalLengthIn35mmFilm | 0xA405 | The same lens expressed as its full-frame equivalent, so you can compare a phone to an SLR. | 24 mm |
| LensModel / LensMake | 0xA434 / 0xA433 | The lens as the body identified it. On phones this names the individual camera module. | iPhone 15 Pro back camera 6.86mm f/1.78 |
| BodySerialNumber | 0xA431 | Serial number of the camera body. A unique identifier that links every photo you have ever published to the same physical camera. | XK4928571 |
| LensSerialNumber | 0xA435 | The same, for the lens. | 0000c15678 |
| ColorSpace | 0xA001 | 1 means sRGB. 65535 means "uncalibrated", which in practice usually signals Adobe RGB or Display P3 and sends the reader to the ICC profile instead. | 1 (sRGB) |
| WhiteBalance / ExposureMode | 0xA403 / 0xA402 | 0 auto, 1 manual. ExposureMode adds 2 for auto-bracket. | 0 (auto) |
| UserComment | 0x9286 | A free-text field. Software drops all sorts of things here — including, on some AI image tools, the generation prompt. | — |
| MakerNote | 0x927C | One tag the standard sets aside for the manufacturer to fill with whatever it likes, in whatever format it likes. Often the largest block in the file. See EXIF data by camera brand. | (binary) |
GPS IFD — the location directory
A separate directory with its own numbering, so 0x0002 here is latitude, not something in IFD0. This is the block worth understanding before you post a photo of your house.
| Field | Tag | What it means | Privacy risk |
|---|---|---|---|
| GPSLatitude / GPSLongitude | 0x0002 / 0x0004 | Coordinates as three rationals — degrees, minutes, seconds. Sign is not stored here: the paired GPSLatitudeRef (N or S) and GPSLongitudeRef (E or W) carry the hemisphere. Strip one and keep the other and you get a coordinate mirrored across the equator. | High |
| GPSAltitude | 0x0006 | Metres above sea level; GPSAltitudeRef flips it to below. In a tall building this can imply a floor. | High |
| GPSTimeStamp / GPSDateStamp | 0x0007 / 0x001D | The satellite clock, always UTC. Compare it with DateTimeOriginal and you recover the timezone the camera was set to, even on files with no offset tag. | Medium |
| GPSImgDirection | 0x0011 | Compass bearing the camera was pointed, 0–360°. GPSImgDirectionRef says whether that is true north (T) or magnetic (M). | Medium |
| GPSHPositioningError | 0x001F | The device's own estimate of horizontal error, in metres. A small value here is the camera telling you the fix is precise. | Medium |
| GPSProcessingMethod | 0x001B | How the fix was obtained — a satellite lock, a cell tower, a Wi-Fi lookup, or a coordinate typed in by hand. | Low |
| GPSSpeed / GPSSpeedRef | 0x000D / 0x000C | Speed of the receiver at capture, in km/h, mph, or knots. Mostly seen on drones and action cameras. | Low |
Not every geotagged photo carries every field, and a missing GPSLatitude does not mean the photo is anonymous — GPSProcessingMethod or a stale GPSDateStamp can survive a partial strip. GPS data in photos goes deeper on how the coordinates get there.
IFD1 — the thumbnail directory
A second, near-complete image directory describing a small preview — typically 160×120 pixels — embedded in the file so a camera can draw a gallery without decoding full-size JPEGs. Its fields are mostly the JPEG offset and length, JPEGInterchangeFormat and JPEGInterchangeFormatLength.
It matters for one reason: the thumbnail is a separate image. An editor that crops the main photo but forgets to regenerate IFD1 leaves the original, uncropped scene sitting inside the file. This is not theoretical — in 2003 the TV presenter Cat Schwartz published headshots cropped from photos she had taken of herself, and readers extracted the untouched originals straight out of the EXIF thumbnail. Modern editors regenerate it, but "modern" is doing work in that sentence.
How Cameras Write EXIF Data
When the shutter closes, the image processor does two jobs at once. It turns sensor readings into a compressed image, and it polls everything else the device knows — the lens position, the exposure the meter chose, the clock, the GPS receiver, the accelerometer that decides which way is up — and serialises that into a metadata block. Both are written into one file.
In a JPEG, that block goes in an application segment called APP1, marked by the bytes FF E1 near the very start of the file, before any pixel data. Inside it is the ASCII string Exif\0\0, and after that something surprising: a complete, self-contained TIFF file header. EXIF did not invent a container. It reused TIFF's.
What that header contains, in order:
- Two bytes of byte order:
IIfor little-endian (Intel) orMMfor big-endian (Motorola). Every number that follows must be read in that order. Canon writesII; some Nikon bodies writeMM. A reader that assumes one gets garbage from the other. - The number 42, as a sanity check that you read the byte order correctly.
- An offset to IFD0, the first image file directory.
- Each IFD is a count followed by 12-byte entries: two bytes of tag ID, two of data type, four of component count, four for the value. If the value fits in four bytes it sits right there; if not, those four bytes are an offset to where the value actually lives.
- Each IFD ends with a pointer to the next one, which is how IFD0 reaches the thumbnail directory IFD1. The Exif SubIFD and GPS IFD hang off IFD0 as pointer tags rather than as siblings.
Two consequences fall straight out of that design. APP1 is capped at roughly 64 KB, which is why the embedded thumbnail is postage-stamp sized and why bulky data goes elsewhere. And because values are reached by absolute offsets, moving the block breaks anything that stored its own offsets internally — exactly what most MakerNotes do. Re-save a photo in an editor that rebuilds the EXIF block, and the maker notes can be silently corrupted or dropped even though nothing asked to delete them.
Other formats, same tags, different envelope
The tag glossary above is universal. Where the block is glued in is not:
- TIFF needs no envelope — the file already is one.
- HEIC and AVIF keep it as an item in the ISO base media container, which lifts the 64 KB ceiling.
- WebP stores it in a RIFF chunk named
EXIF. - PNG was retrofitted with an
eXIfchunk. Older PNGs predate it and carry no EXIF at all — which is why a screenshot usually looks empty in a viewer. - RAW files (CR2, NEF, ARW) are TIFF variants built around the EXIF structure, so they carry the most complete metadata of anything on this list.
The camera is not the only writer
Every program that touches the file afterwards can add, change, or delete tags. Lightroom stamps Software. Phone galleries write GPS after the fact from a location track. Editors refresh DateTime on every export. And a photo that never saw a lens — a scan, a screenshot, an AI generation — can still carry EXIF, because EXIF is just bytes anyone may write.
Which is the honest answer to whether EXIF proves anything: it records what the writing software claimed, not what happened. Our guides on changing the EXIF date and time and working out when a photo was taken cover both sides of that.
Which Apps Read EXIF, and Which Strip It
Two questions people conflate. Reading is about whether an app will show you the metadata. Stripping is about whether an app deletes it from a copy it passes on. An app can do both, one, or neither — Apple Photos reads EXIF happily and strips nothing unless you ask.
Apps that read EXIF
| App | How much it shows |
|---|---|
| ExifTool | Everything, including decoded MakerNotes for hundreds of camera models. The reference implementation; when tools disagree, it is right. |
| This site's viewer | Every standard tag plus GPS and thumbnail, parsed in your browser. Nothing is uploaded. |
| Apple Photos / Preview | Common fields via the Info panel, and a map for GPS. No MakerNotes. |
| Windows File Explorer | A curated subset in Properties → Details. It hides anything it has no property handler for. |
| Lightroom / Capture One | Full standard set plus lens corrections read from MakerNotes. |
| Google Photos | Camera, exposure, and location in the info pane — and uses the timestamp to sort your library. |
Step-by-step instructions for each platform are in how to read EXIF data.
Who strips it, and who does not
| Where the photo goes | EXIF behaviour |
|---|---|
| Instagram, Facebook, X, LinkedIn, TikTok | Strip EXIF from what they serve to other users. |
| WhatsApp, Signal | Strip EXIF from photos sent inline. |
| Any chat app, sending "as a file" | Preserves everything. Choosing "document" instead of "photo" skips the re-encode that would have stripped it. |
| Email, Slack, Discord | Preserve EXIF. An attachment is the bytes you attached. |
| Flickr, 500px, SmugMug | Preserve EXIF deliberately — photographers want it shown. |
| Your own website or CMS | Whatever the image pipeline does. Most preserve by default. |
"The platform strips it" is not the same as "the platform never had it." A social network removing EXIF before serving your photo to other users has already received the original, GPS and all, on its own servers. Stripping protects you from the other users, not from the company.
And the behaviour changes without announcement. The safe habit is to strip locally, once, and stop having to track which app is doing what this year. The platform-by-platform breakdown has the current detail, including the quirks around Reddit and Marketplace listings.
Find out what is actually in your photo
Drop a file into the viewer and read every field in this glossary against your own image. It runs entirely in your browser — the photo is never uploaded.
Open the EXIF ViewerEXIF Data and Privacy Risks
The risk is not that one field is dangerous. It is that the fields combine, and that they are exact where memory is vague.
Location, to the metre
A geotagged photo does not say "taken in Dallas." It gives a coordinate pair a phone believed accurate to a few metres, and often the compass bearing you were facing. Post enough photos from home and the cluster is your address. The canonical demonstration: in 2012 Vice published a photo of the fugitive John McAfee taken on an iPhone, with the GPS tags intact, and readers had his location in Guatemala within hours.
Serial numbers, which link photos to each other
BodySerialNumber and LensSerialNumber are stable identifiers. A photo posted under a pseudonym and a photo on your professional portfolio, both from the same body, share a serial. That is a deanonymising link no amount of care with your name can undo, and it survives cropping.
Timestamps, which build a timeline
DateTimeOriginal to the second, plus SubSecTimeOriginal, plus the UTC GPSTimeStamp, places you somewhere at a time precisely enough to confirm or contradict an account of your movements. Harmless until it is not.
Data you thought you had removed
The embedded thumbnail can predate your crop. A partial strip can leave the hemisphere refs behind. And Windows Explorer's own metadata remover deletes the directory entries while leaving the string values in the file, where a hex editor still finds them — the details are in our Windows removal guide. Verify a strip; do not assume one.
None of this argues for deleting EXIF from everything. It is what lets you learn from your own photography, sort a library by capture date, and prove a photo is yours. The sane position is to know what a given file carries before it leaves your machine — which is a question you can answer in about five seconds. Our photo privacy guide has the full checklist, and remove photo metadata covers stripping on every platform.
Related Guides
Online EXIF Viewer
Read every field in this glossary against your own photo, in the browser, with no upload.
What Is EXIF Data?
The shorter introduction, plus which file formats support EXIF and which do not.
Camera Settings in EXIF
Aperture, ISO, shutter speed and focal length read as photography rather than as tags.
GPS Data in Photos
How coordinates get embedded, what they reveal, and how to turn geotagging off.
EXIF Data by Camera Brand
What Canon, Nikon, Sony, Fujifilm, and Apple each hide in the MakerNote block.
Remove Photo Metadata
Strip EXIF on Windows, Mac, Linux, iPhone, and Android — and verify it worked.
Photo Privacy Guide
What your photos reveal about you, and a checklist for sharing them safely.
How to Read EXIF Data
Step-by-step for iPhone, Android, Mac, Windows, and the web.
Frequently Asked Questions
What is EXIF data in simple terms?
EXIF data is a set of hidden notes your camera writes inside the photo file when you take the picture. It records the device, the exposure settings, the exact date and time, and — if location is switched on — the GPS coordinates. You cannot see it by looking at the photo, but any EXIF viewer can read it back out, and it travels with the file when you send it.
What does EXIF stand for?
Exchangeable Image File Format. It is a specification maintained by CIPA and JEITA in Japan that defines the metadata tags and where they sit inside an image file. The current version, EXIF 3.0, was published in 2023 and added support for UTF-8 text.
Where is EXIF data stored inside a photo file?
In a JPEG, it lives in an application segment called APP1, near the start of the file and before the pixel data. That segment contains a complete TIFF header, and the tags are organised into directories: IFD0 for the image, an Exif SubIFD for exposure, a GPS IFD for location, and IFD1 for the embedded thumbnail. HEIC, WebP, and PNG use the same tags but wrap them differently.
What is the difference between DateTime and DateTimeOriginal?
DateTimeOriginal (0x9003) is when the shutter fired, and editors leave it alone. DateTime (0x0132) is when the file was last changed — ExifTool shows it as ModifyDate. A camera sets both to the same value; a photo that has been re-saved has a later DateTime. If you want to know when a photo was taken, read DateTimeOriginal.
Which apps strip EXIF data automatically?
Instagram, Facebook, X, LinkedIn, and TikTok strip EXIF from the images they serve to other users. WhatsApp and Signal strip it from photos sent inline. Email, Slack, Discord, Flickr, and most self-hosted sites preserve it in full — as does any chat app when you send the image "as a file" rather than as a photo. Note that a platform stripping EXIF before publishing still received your original, coordinates included.
Is EXIF data a privacy risk?
It can be. GPS coordinates are the obvious one — accurate to a few metres, and a cluster of photos from home is your address. Less obvious: the camera body serial number links photos across accounts and pseudonyms, and an embedded thumbnail can preserve the scene you cropped out. For everyday snaps this rarely matters. For anything published under a name that is not yours, strip the file first and verify the strip.
Can EXIF data be trusted as proof of when or where a photo was taken?
Not on its own. Every tag can be edited with freely available tools, and a file that never saw a camera — a screenshot, a scan, an AI generation — can carry a full set of plausible EXIF. It is useful supporting evidence, especially when several independent fields agree, but it records what the writing software claimed, not what happened.
What is the difference between EXIF, IPTC, and XMP?
EXIF is the technical data the camera records at capture. IPTC holds editorial information a human adds — caption, keywords, credit, copyright. XMP is Adobe's extensible XML format, used for edit history, ratings, and anything the other two have no field for. A single JPEG can carry all three at once, in different segments, which is why stripping EXIF alone does not necessarily leave a clean file.
See the glossary against your own photo
Every field above, decoded from your file, in your browser. No upload, no account, no install.
Open Photo Metadata Viewer