What hides inside a QR image — and what stripping can and cannot fix
A QR code is a pattern of pixels, but the file that carries it can hold much more. A photograph taken on a phone often embeds EXIF data: the camera model, the date and time, and sometimes precise GPS coordinates. Editing software can add its own history, colour profiles, and thumbnail previews. A PNG exported from a design tool can carry text chunks naming the software, the author, or the creation time. None of this is visible in the image, which is exactly why it leaks: people share the picture they can see and forget the data riding along inside the file.
Stripping works by refusing to copy the container. When this tool draws your image onto a canvas, it copies only the pixel grid — the colours of each point in the picture. Exporting that canvas as a new PNG produces a fresh file whose only contents are those pixels plus a minimal header. The EXIF block, the thumbnail, the XMP packet, and the colour profile are gone, not because they were individually deleted but because they were never part of the pixels and nothing carried them across. That is also why this tool does not print a list of the metadata it removed: it never parses the original metadata fields at all. It discards the whole container and says so plainly.
The trade-offs are small but worth knowing. A re-encoded PNG may be larger or smaller than the original, and its colours may shift slightly if the original relied on a custom colour profile. The pixels themselves are copied at the original resolution, so the QR pattern is unchanged — but always scan the stripped copy before sharing it, because any re-encode deserves one verification pass. If you need a JPEG rather than a PNG for a specific workflow, convert the stripped PNG with your usual tool and strip again if that tool re-adds metadata.
Stripping is necessary but not sufficient for privacy. The pixels themselves can give you away: faces, licence plates, screens, whiteboards, reflections in glass, street signs, and distinctive rooms all survive stripping untouched. If a photo of a QR code was taken in a sensitive place, the location may be obvious from the background even with GPS metadata removed. Crop the image to the code and its margin, blur or cover anything else, and consider whether a clean export of the code — rather than a photo of it — would serve better.
For teams that publish QR artwork, the cleanest habit is to generate the code as a vector or PNG from a generator rather than photographing a screen or printout, and to strip any photo that must be shared. Make stripping part of the publishing checklist: generate, strip, scan the stripped copy, then share. It takes seconds, it runs entirely in the browser, and it removes a whole class of accidental disclosure.