Metadata Folder Cleaner

A Windows app that strips identifying metadata from your files before you send them anywhere — photos, videos, PDFs, Office docs. GPS tags, author names, device serials, document edit history, that kind of thing.

You point it at a folder (or just drag in a few files) and it makes a cleaned copy next to your originals. It never touches the source files.

What it cleans

• Images — JPEG, TIFF, PNG, WebP, HEIC, HEIF, AVIF, GIF, BMP (via ExifTool)
• Video — MP4, MOV, M4V, 3GP, AVI, MKV, WebM, WMV, FLV (via FFmpeg)
• Audio — MP3, M4A, AAC, WAV, FLAC, OGG, WMA (via FFmpeg)
• PDF — full QPDF rewrite + ExifTool, including JavaScript actions and metadata hiding in embedded page images
• Office — DOCX/XLSX/PPTX and friends, plus legacy DOC/XLS/PPT via Office COM automation
• OpenDocument — ODT, ODS, ODP

Pick a folder or just drag in files

You can scan a whole folder like before, or select/drag individual files straight onto the window — no folder needed. Drop a mix of files and folders together and it sorts itself out (each folder gets its own subfolder in the output so nothing collides).

If tkinterdnd2 isn't available for some reason, drag-and-drop just quietly doesn't work and you fall back to the Browse buttons — nothing breaks.

Why trust it

Every file gets cleaned by one tool and then checked by at least one different tool, so you're not just trusting the same code twice. A JPEG gets checked by ExifTool, Exiv2, and ImageMagick independently, for example. There's also a built-in binary scanner that looks for stray emails, GPS coordinates, Windows usernames, etc. left over in the raw bytes.

Nothing is ever silently "probably fine" — if a file can't be cleaned or verified, it's copied over unchanged and flagged as such in the report, never marked clean when it isn't.

No tool can promise it caught everything — visible text, watermarks, faces in photos, and deliberately hidden payloads are outside what metadata removal can do anything about.

Running it

python -m pip install -r requirements.txt
python main.py

You'll also want exiftool.exe, ffmpeg.exe/ffprobe.exe, and qpdf.exe somewhere on PATH or next to the app — it can download and install these for you from the Cleaning engines panel. Office/OpenDocument files are handled directly and don't need Microsoft Office installed at all; only legacy DOC/XLS/PPT need it.

Building the exe

Set-ExecutionPolicy -Scope Process Bypass
.\build_windows.ps1

Comes out at dist\MetadataFolderCleaner.exe.

Reports

Every run writes a JSON, CSV and HTML report next to the output — what was cleaned, what tools touched it, any leftover metadata found, SHA-256 hashes of before/after, how long each file took.

---

Changelog

0.12.0

• source can now be a single file, not just a folder
• new "Browse files..." button for picking several files at once
• drag and drop files/folders onto the window
• dropping multiple items shows "+N more selected" — click it to clear
• single-folder runs still map straight to the output like always; multiple sources get their own subfolder each, with automatic (2), (3) suffixes on name clashes
• containment check (source can't be inside destination or vice versa) now covers every selected item, not just the first one

0.11.1

• renamed the report's "Engine" column to "Cleaning engine" — it only ever showed the tool that wrote the file, not the tools that verified it, which was confusing next to the Evidence column

0.11.0

• PDFs: strip auto-run JavaScript (/OpenAction, /AA, named JS entries) — this is a known PDF tracking trick and QPDF/ExifTool never touched it
• PDFs: flag embedded file attachments in the report instead of ignoring them (never auto-deleted — that's the user's content, not metadata)

0.10.0

• added an opt-in "rebuild images from raw pixels" mode — fully decodes and re-saves the image instead of just stripping tags, which also nukes anything hidden outside the normal tag structure (e.g. bytes appended after the JPEG end marker). Off by default since it costs a little JPEG quality. Doesn't cover HEIC/HEIF/AVIF, falls back automatically for those.

0.9.3

• every external tool call now has a timeout (10 min default) so a hung/corrupt file can't freeze the whole run
• added zip-bomb protection for Office/ODF files — checks compression ratio before decompressing anything

0.9.2

• fixed Office files scoring way lower Privacy Confidence (57) than everything else (86+) even though just as much actually ran on them — the scoring was cross-checking against a tool registry that didn't know about our own built-in sanitizer or a couple of the bundled verifiers

0.9.1

• fixed a crash: subprocess output was decoded using the Windows default codepage instead of UTF-8, so tools writing non-ASCII output (e.g. Hebrew filenames) could crash a background thread mid-run

0.9.0

• found that PDFs built from scanned/photographed pages could still carry the embedded photo's original EXIF (GPS included) even after cleaning — QPDF/ExifTool only ever touched the PDF's own metadata, not images buried inside it. Now walks the page images directly with pikepdf and cleans those too.
• tightened the binary scanner's email regex — it was flagging things like E@.J.Xma inside raw JPEG/MP4 bytes as "emails"

0.8.0

• Office files now get a second, fully independent metadata check via python-docx/openpyxl/python-pptx, on top of ExifTool
• fixed cleaned Office files failing to open in other tools — we were deleting docProps/core.xml but leaving a relationship pointing at it, which is invalid and some readers (correctly) throw on it

0.7.5

• fixed a false positive that was tanking Privacy Confidence on ~40% of images (ImageMagick's comment: line is present-but-empty on plenty of ordinary JPEGs, we were treating that as leftover metadata)
• fixed MuPDF verification silently failing on non-ASCII paths (same class of bug ExifTool already had a workaround for)

0.7.4

• evidence in the report now reflects tools that actually ran on that specific file, not tools that just happen to be installed
• Ghostscript, MuPDF and ImageMagick now really do run as independent verifiers (they were registered but never invoked before)
• source/destination containment check is now bidirectional, and enforced by the engine itself, not just the GUI
• mirror verification now fails properly when there are unexpected files in the destination

0.7.3

• destination now always mirrors the source 1:1, even for unsupported/disabled/failed files — everything gets copied through in some form so nothing just goes missing
• adds destination mirror verification (PASS/FAIL) to the reports

0.7.2

• MKVToolNix install now goes through its own installer instead of the portable archive

0.7.0

• MKVToolNix now re-detected only after its installer actually exits, fixes a WinError 5 from copying its temp files

0.6.6

• engine detection got a lot more conservative — no more scanning every installed program on your PC, only known paths and manually-registered ones
• every "FOUND" engine is now actually launched to confirm it works, not just checked for existing on disk

0.6.1

• moved engine installs to %LOCALAPPDATA%\MetadataFolderCleaner\tools so they survive app upgrades
• activity log is now selectable/copyable
• update checker shows installed vs. latest version side by side

0.5.4

• fixed Hebrew/English mixed paths displaying in the wrong visual order in the path fields

0.5.0

• installer UI cleanup, ImageMagick install no longer needs a separate 7-Zip dependency

0.4.3

• Install all missing now covers ImageMagick, Ghostscript, MuPDF, MP4Box, MKVToolNix and metaflac too
• engine table layout fixes for maximized windows

0.4.1

• rebuilt the engine system around a proper registry (roles, formats, priority, independent tool families)
• added the built-in binary privacy scanner (catches emails, GPS coords, Windows paths, SIDs, EXIF/XMP/IPTC signatures left in raw bytes)
• added per-file evidence + a Privacy Confidence score (a file cleaned by only one tool can't hit 100)
• media cleanup now actually runs format-specific cleaners (MP4Box for MP4, MKVToolNix for MKV, metaflac for FLAC) instead of just FFmpeg

0.3.0

• PDF pipeline is now QPDF rewrite → ExifTool → second QPDF rewrite (collapses incremental updates so old metadata can't be recovered from the file)
• added online update checks for ExifTool/FFmpeg/QPDF/Exiv2/MediaInfo
• ExifTool now always runs against ASCII-only temp paths — fixes reliability on Hebrew/non-ASCII Windows paths

0.2.7

• stopped flagging harmless technical fields as "residual metadata" (FFmpeg's Lavf encoder tag, zeroed MP4 dates, normalized zip timestamps)
• reports now show the full verification pipeline per file

0.2.5

• fixed ExifTool calls breaking on Hebrew file/folder names
• added metadata-cleaner-debug.log with the exact commands run, exit codes, stdout/stderr

0.2.3

• can now auto-install missing engines (ExifTool, FFmpeg, QPDF) straight from their official download pages — no PATH changes, everything lives in a local tools folder

0.2.1

• one-click "automatic" workflow — dropped the per-category checkboxes in favor of just cleaning everything supported

0.1.1

• dark mode, only theme available