A private inspection workflow
Open the metadata viewer and choose a JPEG, PNG or WebP file. The file bytes are passed to browser code and a Web Worker; the image itself is not posted to an AnalyzeImage upload endpoint.
- Verify that the extension matches the detected signature
- Check whether precise location was found
- Review dimensions, megapixels and animation
- Inspect camera, capture, rights and software groups
- Calculate SHA-256 only if you need a comparison fingerprint
What a browser can and cannot tell you
A browser can parse metadata and validate file structure, but it cannot guarantee that the values are truthful. Export software may remove fields, social platforms may rewrite files, and someone can edit metadata deliberately.
Use a result order that answers the real question
A raw table is rarely the best first screen. Begin with whether precise location or persistent identity fields were found, then check the real format and dimensions. Camera and software details come next; the complete tag table is available when an investigation actually needs it.
This order reduces two common mistakes: overlooking a GPS coordinate inside hundreds of tags and treating a harmless technical value as an urgent privacy problem. It also makes the workflow usable on a phone, where a wide metadata table is difficult to scan.
- Privacy summary
- Location and identifiers
- Real format and dimensions
- Camera and capture
- Software, rights and raw fields
How we verified the local path
The fixture check used the same format detector as the public tool. Three supported byte signatures continued to analysis; an XML payload renamed as a JPEG was stopped with a clear format message. No filename, extension or browser-provided MIME label overrode the bytes.
The test is deliberately small because it proves one boundary: identification before parsing. It does not claim every damaged image can be diagnosed. Truncated headers, unsupported HEIC variants and encrypted or unusual containers can still produce a limited or unsupported result.
Private does not mean invisible to your own browser
Local analysis means the selected bytes are handled by code in your browser and are not posted to an AnalyzeImage upload endpoint. The page itself still loads normal HTML, scripts and fonts from the website. Browser extensions, operating-system malware or a compromised device are outside what a website can guarantee.
For a sensitive image, use an updated browser, avoid unknown extensions and close the file when finished. Calculate a SHA-256 fingerprint only when you need to compare known copies; a hash identifies byte equality but does not reveal whether the scene is authentic.
What this does not prove
A metadata result describes the fields and structures that the supported parser could read. It does not, by itself, prove authenticity, intent, authorship or the truth of the visible scene.