Check That a Metadata Remover Does Not Upload
Last updated · 6 min read
Quick answer
Open the Network tab of your browser developer tools, add a photo and clean it. If no request carries a body as big as your photo, the photo did not leave your device. For a second proof, go offline after the page loads and clean a photo again.
Why test it yourself
Many tools say that your photos stay on your device. A claim costs nothing, and some metadata removers do upload photos to a server. For example, the ImageStripper site says its images are deleted from its servers after one hour, which means they are uploaded first (checked November 6, 2026). You can check the claim in five minutes with the tools that your browser already has.
Prepare the test
- Open a private window. Chrome and Firefox turn extensions off there by default, so requests from extensions do not mix into the result. In Safari, check which extensions you allow in private windows.
- Pick a photo that you do not mind testing with.
- Open the developer tools before you add the photo. The Network tab records only the requests that happen after you open it.
Chrome and Edge
- Press Ctrl+Shift+I (Windows, Linux) or Cmd+Option+I (Mac) and select the Network tab.
- Select All in the filter bar, and click the clear button so the list is empty.
- Add your photo to the tool, clean it and download the result.
- Look at the Method, Type and Size columns. An upload is normally a
POSTorPUTrequest whose body is about as big as the photo. - Click a suspicious request and open its Payload tab to see what it sends.
- Then select the Fetch/XHR filter. This shows the requests that scripts make with fetch and XMLHttpRequest, which is how a web app normally sends data to a server.
Keep All selected for the first look. A tool can also send data with a form, a beacon or a WebSocket, and those are not Fetch/XHR requests.
Firefox
- Press Ctrl+Shift+E (Cmd+Option+E on a Mac) to open the Network tool.
- Add and clean your photo.
- Read the Method and Transferred or Size columns, and select a request to see its headers and parameters.
- Use the XHR button in the toolbar to filter. If a request you expect is missing, go back to All.
Safari
- Open Safari > Settings > Advanced and turn on Show features for web developers.
- Choose Develop > Show Web Inspector, or press Option+Command+I, and open the Network tab.
- Add and clean your photo. The Network tab lists requests with their method, status and size. You can filter by resource type, and it also lists fetch, XHR and beacon requests.
What you should and should not see
| Request | Meaning |
|---|---|
| Page files, scripts, fonts (GET) | The tool loading itself. Normal. |
blob: addresses | Data in your own tab. It does not leave your device. |
| A decoder file such as a WebAssembly file (GET) | The tool downloading code, for example to read HEIC. It is a download to you. |
| Small requests to an analytics domain | Visit statistics. Open one and check its content. |
A POST or PUT with a body the size of your photo | An upload. This is what you are looking for. |
Compare sizes with your photo. A 4 MB photo cannot leave in a small request.
The offline test
This test is simple and hard to argue with.
- Load the tool page while you are online.
- Go offline. In Chrome, Edge and Firefox, open the Network tab and set Throttling to Offline. In Safari, turn off Wi-Fi or switch on airplane mode.
- Add a photo and clean it.
If the tool cleans the photo and gives you the file, it did not need a server. If it fails with a network error, it depends on a server for the cleaning. A tool might still work offline because it saved your photo to send later, so use the offline test together with the Network tab, not instead of it.
Apply it to WipePic
WipePic cleans photos in your browser, so your photos, file names and metadata are not uploaded. WipePic does use Google Analytics for visit statistics, so you will see analytics requests in the Network tab. They do not contain your photos.
We ran this test ourselves on November 5, 2026, with Chromium 150, and published the result on the Zero-Storage Audit page: a 258 KB JPEG with GPS location, camera details and AI labels. The page made no request to a server while it handled the photo, and sent 0 bytes. The only requests were two blob: reads in the browser memory. That is our own test, so repeat it with your photos and decide for yourself. The page Remove Metadata Without Uploading explains the design.
Sources
Chrome DevTools, Network features reference. Firefox Network Monitor. WebKit, Web Inspector Network tab. ImageStripper pricing page, read on November 6, 2026. Menu names can change between browser versions.
Questions
Does the Network tab prove that a tool is safe?
It proves what your browser sent during your test. It does not prove what the site will do after an update. Repeat the test now and then, and use a photo that holds no private data when you test a tool for the first time.
I see requests to Google while I use WipePic. Is that my photo?
No. WipePic uses Google Analytics for visit statistics, so you can see small requests to Google domains. Open one and look at what it sends. It holds no photo. A photo upload would be a request with a body as large as your file.
What does a blob: address mean?
A blob: address points to data in the memory of your own browser tab, such as the preview of the photo you added or the cleaned file before you download it. It never leaves your device.
Why does the offline test fail for my HEIC photo?
The first time you add a HEIC photo, WipePic downloads a HEIC decoder into the tab. Add one HEIC photo while you are online, then go offline and run the test again.
Remove the metadata from your photos
Free. In your browser. Your photos do not go to a server.
Clean a Photo