Wide, or deep.
mat2 is the general-purpose metadata remover from the Tails ecosystem, and it covers file types ScrubPony will not even open. The trade is coverage against depth, and which one you want depends entirely on what is in your folder.
mat2 for a mixed folder; ScrubPony for a folder of JPEGs you need to be certain about. mat2 handles images, documents, audio and archives through a plug-in architecture, which is exactly what you want when the folder contains a PDF, a DOCX and a photograph. ScrubPony handles JPEG and nothing else, in 2,251 lines of dependency-free C, with a published keep/drop table, a fail-closed default for unknown segments, atomic writes asserted under SIGKILL, and a pixel-identity claim you can verify in two commands.
At a glance.
| ScrubPony | mat2 | |
|---|---|---|
| Formats | JPEG only | Images, PDF, office documents, audio, archives |
| Approach | Parse segments, apply a published policy, copy the scan verbatim | Per-format handlers; images are typically rebuilt |
| Image data guarantee | Byte-identical from SOS to EOF, verifiable | Depends on the handler for the format |
| Keeps orientation | Re-emits a 36-byte block automatically | Orientation is metadata and goes with it |
| Keeps ICC colour profile | By default; --strict drops it | Removed as metadata |
| Unknown vendor segments | Dropped by default | The rebuild approach discards them |
| Atomic writes | Temporary, fsync, rename — 30 SIGKILLs asserted | Writes a new file; no interrupt guarantee documented |
| In-place editing | Yes, atomically, permissions preserved | Produces a .cleaned copy by default |
| Dependencies | libc | Python, GLib/GdkPixbuf, poppler, mutagen |
| Platforms | macOS and Linux | Linux, and packaged widely |
| GUI available | Command line only | Nautilus extension, third-party front ends |
| Licence | MIT | LGPL-3.0 |
| Price | Free | Free |
Honest tradeoffs.
Where mat2 wins
- It covers the whole folder. A real folder has a PDF, a screenshot, a spreadsheet and a voice memo in it. mat2 handles all of them; ScrubPony reports and skips everything that is not a JPEG.
- It is packaged everywhere. apt, dnf, pacman, and shipped in Tails. Nothing to build. ScrubPony is git-clone-and-make until a Homebrew tap exists.
- There is a GUI. The Nautilus extension puts "Remove metadata" in a right-click menu, which is the difference between a tool a person uses and a tool a person means to use.
- It is a maximalist by default. mat2 removes orientation and colour profiles too, on the reasonable grounds that they are metadata. If you want everything gone with no judgement calls, that is a coherent position and mat2 takes it.
- It is battle-tested in a hostile context. Shipping in Tails means it is used daily by people whose threat model is serious.
Where ScrubPony wins
- The picture is provably untouched. Everything from the SOS marker to end of file is copied in one operation, with no decoder and no encoder anywhere in the program. tests/verify_scrub.py checks it four ways and finds the SOS offset with its own scanner rather than trusting the tool under test.
- Your portrait photos stay upright. ScrubPony re-emits a minimal 36-byte block holding only the orientation. A folder cleaned by a maximalist tool is a folder of sideways photographs, which is a real cost and the main reason people abandon scrubbers.
- Colour survives by default. The ICC profile is kept unless you ask for --strict, because dropping it visibly shifts colour on a wide-gamut display.
- A published keep/drop table. Every segment kind, its default, its --strict verdict, and the reason, all on one page and matching one switch statement in the source.
- No dependency tree. libc. That is the whole attack surface, and it is 2,251 lines long.
- Interrupt-safe, asserted. 30 SIGKILLs mid-write on a 24 MB in-place scrub, with zero partial files and no stray temporaries.
The verdict.
- Choose mat2 if the folder is mixed, you want one command for everything in it, you are on Linux with a package manager, or you want the maximalist default with no keep/drop judgement calls to think about.
- Choose ScrubPony if the folder is photographs, you care that they still look right afterwards, and you want to be able to demonstrate that the image data is bit-identical.
- Use both if your pipeline has documents in it. mat2 for the PDFs, ScrubPony for the JPEGs, and neither one pretending to be the other.
Common questions.
Does mat2 damage image quality?
That depends on the handler and the format, and it is not a claim worth making loosely. What is worth saying is the positive version: ScrubPony provably does not re-encode, because there is no encoder in it, and it hands you a script to confirm that on your own files.
Why does ScrubPony keep things mat2 removes?
Two of them — EXIF orientation and the ICC colour profile — change how the picture looks rather than who it identifies. ScrubPony keeps the first always and the second by default, and says plainly that this means the default is not maximum paranoia. --strict and --no-keep-orientation take the other position.
Can I use ScrubPony on Tails?
It builds anywhere with a C99 compiler and POSIX.1-2008, so yes in principle, though mat2 is already there and packaged.
Try ScrubPony
Free and MIT-licensed. No dependencies beyond libc, no configure step, and a pixel claim you can check in two commands.