Everything you need, nothing inflated.

The one-liner

ScrubPony strips identifying metadata out of JPEG files without altering a single pixel.

The one-paragraph version

A photo off your phone carries GPS coordinates accurate to a few metres, the capture time, the device serial, and often an uncropped thumbnail of what you cropped out. ScrubPony is a command line tool that removes all of it and provably does not touch the image: everything from the JPEG's SOS marker to the end of the file is copied through verbatim. It is written in C99 against POSIX.1-2008 with no dependencies beyond libc, runs on macOS and Linux, and is MIT-licensed at github.com/norsehorse-dev/ScrubPony.

Facts

Figures

CI runs the full suite on both platforms with both compilers on every push, plus a timed libFuzzer job.

The angles worth taking

• The marker code never decides. APP1 is EXIF or XMP; APP2 is an ICC colour profile or an MPF block that can hold an entire second photograph. One of each pair is kept and the other dropped, and only the identifier string tells them apart. Getting that wrong is how a naive scrubber either wrecks your colours or silently leaves behind the coordinates it promised to remove.
• It fails closed. Unrecognised APPn segments are dropped by default, because an undocumented vendor segment is exactly where a manufacturer parks a serial number.
• Your portrait photos do not come out sideways. Phones do not rotate pixels; they record an EXIF orientation tag. Drop EXIF and that instruction goes with it, which is why most metadata strippers leave you a folder of sideways photographs. ScrubPony writes back a minimal 36-byte block containing exactly one field.
• Losslessness is provable, not asserted. The test suite verifies it four ways and deliberately locates the SOS offset with an independent scanner rather than asking ScrubPony where it thinks the scan starts.
• It tells you what it found. The line people react to is 257 carried GPS coordinates.

Do not write

This is a privacy tool, and overclaiming about one is worse than underselling it. Please avoid:

• Not "removes all metadata from any image." It handles JPEG only. PNG, HEIC, RAW, TIFF and video are out of scope today.
• Not "anonymises your photos." It removes container metadata. It cannot touch anything encoded in the pixels — invisible watermarks, a reflection in a window, a visible street sign.
• Not "Windows support." Out of scope by design; the safety guarantees rest on POSIX semantics that differ there.
• BSD is untested, not unsupported. Please word it that way.
• -i loses extended attributes (Finder tags, Spotlight comments, quarantine flags) and breaks hard links, because replacing a file installs a new inode. This is documented, not hidden.
• The mtime is deliberately reset — it is metadata too. Readers are surprised by this, so lead with it rather than let them discover it.
• ICC colour profiles are kept by default (dropping them shifts colour). --strict drops them. Please do not imply the default is maximum paranoia.
• Please do not invent a rating, an audit, a user count, or a roadmap commitment. None exist.

Sample output

Real, and safe to reproduce:

$ scrubpony -r -d ~/clean ~/Pictures
scrubpony: 834 scrubbed, 366 already clean, 3 not JPEG, 4 skipped, 2 failed
scrubpony: 1148605 bytes of metadata removed
scrubpony: 257 carried GPS coordinates
scrubpony: 266 rely on EXIF orientation to display correctly (266 preserved)

Assets

Use freely when writing about ScrubPony.

• App icon, 1024×1024 PNG
• App icon, 512×512 PNG
• Social card, 1200×630 PNG

Accent colour #9d7cf5. Capitalisation: the project is ScrubPony, the binary is lowercase scrubpony. Keep that split — nobody wants a capital letter in a shell command.

The family

ScrubPony is one of seven tools by the same developer, all following the same rules: no accounts, no tracking, inspectable code. The others are listed here.

Questions

One developer, one inbox: NorseHorse@norsehor.se. Happy to answer technical questions on the record, and happy to be told a claim on this page is too strong.