What Is Hiding Inside a QR Image File
A QR image is not just black and white modules. JPEG files can carry an EXIF block with the camera make and model, the date and time, the software that saved the file, and — most sensitively — GPS coordinates. PNG files can carry text chunks with author names, software, or notes. This auditor parses the actual bytes of the file you upload and lists the fields it finds, so you can decide whether the file is safe to share.
Why GPS metadata matters most
GPS coordinates in a photo can reveal where the photo was taken to within a few metres — a home, a school, a clinic, or a workplace. That is why this auditor flags GPS first and loudest. If you see coordinates here, strip the metadata before posting the image anywhere public. The same applies to the date and time: combined with a location, a timestamp can reveal when someone was somewhere.
What this auditor can and cannot see
It reads the standard EXIF fields in JPEG files (camera, software, dates, GPS) and the text and EXIF chunks in PNG files. It does not read proprietary maker-note blocks in full, and it cannot see metadata that a tool stored outside the image file itself. A clean result here means none of the common fields were present — a good sign, but not a guarantee for files that passed through unusual tools.
- Before sharing a QR image publicly, run it through this auditor.
- If GPS or a date is present, strip the metadata or re-export the image without it.
- Keep the original file with metadata only in a private folder, not in a shared album.
- Re-check after editing: some editors re-add software or date fields on save.