Publish the picture. Not the address.

The problem with forwarding a photo

The three fields that matter most are the three nobody sees. GPS coordinates in EXIF are typically accurate to a handful of metres — enough to identify a home, a workplace, or the corner someone was standing on. The capture timestamp puts a person somewhere at a moment. The device serial in the maker notes links every photograph from that camera to every other one, across accounts and years.

Then there is the thumbnail. It is written at capture and many editors do not update it when you crop, so the version you cropped out can still be sitting inside the file you sent. That failure has a body count of published mistakes behind it.

What ScrubPony changes

• The whole EXIF block goes, thumbnail and GPS and serial included — not selected fields, the block.
• XMP and IPTC go too. Editing software frequently copies the coordinates into XMP, so a tool that handles EXIF alone leaves the location in the file in plain text.
• Unrecognised vendor segments are dropped by default. An undocumented block is exactly where a manufacturer parks a serial number, and this tool does not need to know what a segment is in order to remove it.
• The photograph is bit-identical. No re-encoding, no generation loss, nothing that would compromise a picture destined for print. You can verify that in two commands.
• It runs offline. There is no network code in the program at all. Nothing about a sensitive image reaches anybody while you clean it.
• It works on the folder. A whole set, mirrored into a clean tree, originals untouched, in seconds.

A workable pattern

• Ask sources to send originals rather than screenshots, and scrub on your machine — a source who tries to scrub under pressure with an unfamiliar tool is a source who may do it wrong.
• Keep the untouched original in a place that never leaves the building, and work from a scrubbed copy: scrubpony -r -d ~/clean ~/incoming.
• Run scrubpony --check -r over the publication folder as a last gate before anything is filed.
• Then look at the picture. That part is not automatable.

Honest limits

This removes container metadata. It does not make a photograph anonymous, and treating it as though it does is the most likely way to be hurt by it.

It cannot touch what is in the pixels: a street sign, a house number, a reflection in a window or in someone's glasses, a distinctive skyline, a screen in the background with an email client open on it, or an invisible watermark encoded into the image by whoever made it. Camera sensor noise patterns can also link photographs to a specific device, and no metadata tool addresses that.

It handles JPEG only — a HEIC from an iPhone or a RAW from a camera is reported and skipped. It cannot recall an image that has already been uploaded, emailed or backed up. And the atomic rename that makes it safe to interrupt says nothing about whether the pre-scrub bytes are recoverable from the drive afterwards; on a copy-on-write filesystem, an SSD, or anything with snapshots, they may well be.

Metadata removal is a floor. The editorial work of looking hard at what a photograph shows is the part that actually protects a source.

Common questions.