EXIF, IPTC and XMP: which one is in your photo?
Three standards with three different authors — the camera, the person and the software — and the same fact stored in all three at once.
The short version is that they were written by different people for different jobs. EXIF is what the camera recorded: shutter, aperture, lens, time, often GPS. IPTC is what a person typed: a caption, a credit, keywords, a city and a country. XMP is what the software did: the edit history, the document identifiers, and a copy of most of the other two. That much is on every page that answers this question. The useful part is what none of them gets to, because it needs your actual file: which of the three you have, and what it means when they contradict each other. CLOAK reads all three in the page and prints them separately, so you can see for yourself.
What each one is, and where it lives
| Standard | Written by | Holds | Lives in |
|---|---|---|---|
| EXIF | The camera, at the moment of capture | Make, model, lens, serial number, exposure, orientation, timestamps, GPS, and a small thumbnail of the picture | A JPEG's APP1 segment, as a TIFF structure. A PNG's eXIf chunk, which is the same TIFF without the wrapper |
| IPTC | A person, usually filing or publishing the picture | Title, caption, keywords, creator, credit, source, copyright, and a city, state and country in plain text | A JPEG's APP13 segment, inside a Photoshop resource block, as IIM datasets. Effectively never in a PNG |
| XMP | Software, whenever it saves the file | Creator tool, create and modify dates, document and instance identifiers, the edit history, and its own copy of most of the fields above | A second APP1 segment in a JPEG, as RDF/XML. An iTXt chunk in a PNG |
So a single JPEG can be carrying three separate metadata blocks written by three separate things at three separate times, none of which knows what the others said.
The same fact, stored in two or three places at once
This is the part that matters and the part the definitions skip. The three standards overlap, and they overlap on exactly the fields people care about. Six of them:
| The fact | In EXIF | In IPTC | In XMP |
|---|---|---|---|
| Who took it | Artist | By-line | dc:creator |
| What it is of | — | Caption | dc:description |
| When | DateTimeOriginal | Date Created | xmp:CreateDate |
| Copyright | Copyright | Copyright Notice | dc:rights |
| Keywords | — | Keywords | dc:subject |
| Where | GPS coordinates | City, state, country | Iptc4xmpExt location |
The duplication is deliberate and it is a known problem. The Metadata Working Group — Adobe, Canon and Microsoft among others — published guidelines in 2010 setting out how software should reconcile the three when they disagree, and picked nine properties to do it for: keywords, description, date and time, orientation, rating, copyright, creator, location created and location shown. A specification existing to tell applications how to resolve contradictions is a good sign that applications were producing them.
What it means when they disagree
They are meant to be kept in step. When they are not, something wrote one of them and left the others alone, and the shape of the mismatch tells you roughly what:
- XMP has a date, EXIF's capture date is older. Ordinary. The first is when the file was last written, the second is when the shutter fired.
- IPTC has a caption and XMP does not, or the two say different things. Something wrote one form and not the other. A tool that predates XMP, or one that writes IPTC only because that is what its workflow expects.
- EXIF is gone entirely, IPTC and XMP remain. This one is worth looking at. It usually means a cleaning pass removed the block somebody had heard of and left the other two behind.
- The creator fields disagree. The picture has passed through more than one person's hands, or more than one program's idea of who owns it.
For a privacy question the conclusion is blunter than any of that. Removing one of the three removes one of the three. There is no operation that takes the EXIF out and takes the other two with it, except re-encoding the picture.
The one that catches people out: a place with no coordinates
IPTC's location fields are plain text typed by a person. They are not coordinates and nothing derives them from GPS, so stripping the GPS does not touch them. A photograph with its EXIF removed can still carry Islington, Greater London, United Kingdom in a field, and every tool that reports "no location data found" because it only looked at the GPS tags is telling the truth about the wrong thing.
CLOAK reads the IPTC fields and says so explicitly when a file names a place in text with no coordinates anywhere in it, because that is precisely the case where somebody has stripped the part they knew about and stopped.
How to see which yours has
Open the photo in CLOAK. The readout lists the segments the file actually contains and then prints each standard under its own heading: the EXIF fields, the IPTC fields, the XMP fields, and the edit history if there is one. Nothing is uploaded and it works with your connection off.
Exporting a cleaned copy re-encodes the pixels, which is the only operation that removes all three at once — the new file is built from the decoded image, so none of the blocks wrapped around the old one has a path into it.
What this is and is not
This is a description of where things are kept and what it means when they disagree. It is not a cataloguing guide: if you are filing photographs professionally, IPTC's own documentation is the reference, and it is good.
CLOAK does not write metadata, only reads and removes it. It reads uncompressed text and the standard XMP packet; a compressed text chunk in a PNG is named and not decoded, and it says so rather than passing over it. And none of this is a claim about what a service does to your file after you have sent it, which is the one thing no tool on your own machine can tell you.
Questions people ask about EXIF, IPTC and XMP: which one is in your photo?
What is the actual difference between the three?
Who writes them. EXIF is what the camera recorded at the moment of capture: shutter, lens, time, often GPS. IPTC is what a person typed when filing or publishing the picture: a caption, a credit, keywords, a city and a country. XMP is what software wrote when it last saved the file: the creator tool, the identifiers, the edit history, and its own copy of most of the other two.
Where does each one sit in the file?
In a JPEG, EXIF is a TIFF structure in an APP1 segment, IPTC is IIM data inside a Photoshop resource block in APP13, and XMP is RDF/XML in a second APP1. In a PNG, EXIF goes in an eXIf chunk and XMP in an iTXt chunk; IPTC effectively never appears there.
Why is the same information in more than one of them?
Because the standards were written separately and then had to coexist. Who took it, what it is of, when, the copyright, the keywords and the location are each stored in two or three of them at once. The Metadata Working Group — Adobe, Canon and Microsoft among others — published guidelines in 2010 on how software should reconcile them, covering nine properties. A specification existing to resolve contradictions is a good sign applications were producing them.
What does it mean when they disagree?
That something wrote one and left the others alone. XMP holding a later date than EXIF's capture time is ordinary — they answer different questions. IPTC carrying a caption that XMP does not usually means a tool that predates XMP or ignores it. EXIF gone while IPTC and XMP remain is the one worth looking at: it usually means a cleaning pass removed the block somebody had heard of.
If I strip the EXIF, is the photo clean?
No. Removing one of the three removes one of the three. There is no operation that takes the EXIF out and the other two with it, except re-encoding the picture — which is what exporting a cleaned copy from CLOAK does, because the new file is built from the decoded pixels and nothing wrapped around the old ones has a path into it.
Can a photo say where it was taken without any GPS?
Yes, and this is the one that catches people out. IPTC's city, state and country are plain text typed by a person. Nothing derives them from GPS and stripping the GPS does not touch them, so a photograph with no coordinates at all can still name the place in a field. A tool that reports "no location found" after looking only at the GPS tags is telling the truth about the wrong thing.
Which one should I care about?
For privacy, all three, because they carry different things and no single operation removes them together. For photography and filing, IPTC and XMP are where the descriptive work lives and IPTC's own documentation is the reference. For working out what happened to a file, XMP, because it is the only one of the three that records a sequence.
How do I see which ones my photo has?
Open it in CLOAK. The readout lists the segments the file actually contains and then prints each standard under its own heading — the EXIF fields, the IPTC fields, the XMP fields, and the edit history if there is one. Nothing is uploaded and it works with your connection off.