- Fields classified as private or descriptive by the active format engine
- Artwork and thumbnails where the active handler supports removal
- Original metadata structures that can survive a superficial edit
METHODOLOGY
How local metadata cleaning works
Trust should come from an inspectable process, not a vague “clean” badge. KillMetadata follows the same sequence for every supported file: identify, inspect, plan, rewrite and verify separately in a fresh worker.
THE CLEANING PLAN
Remove what exposes you. Keep what makes the file work.
Every reported field is shown before the rewrite and classified by action and coverage.
- Functional data required for correct display or playback
- Structural data required for file validity
- The source file itself
- Explicitly required fields such as EPUB language and identifier
- Visible-content redaction
- Steganography detection
- Secure deletion of the source
- Filesystem attributes outside the browser File object
WHY THE ENGINE MATTERS
Five guarded phases, isolated worker lifetimes
The scanner identifies a file from its bytes and internal structure. It emits logical fields with their native carrier, privacy class, risk, editability and coverage. A clean plan is then expressed as bounded copy, write and zero operations or a format-specific structural rewrite.
The original is never modified. Scan, rewrite, and verification run in separate dedicated-worker lifetimes; each task worker is terminated after its phase. The verifier reads the output from bytes and produces verified-clean, partial or rejected. File bytes and reports are not persisted to Cache Storage, IndexedDB or localStorage.
Explore the complete verification methodology →BEFORE YOU SHARE
A four-step privacy check.
Metadata cleaning is one part of a safe sharing workflow.
- 01Identify by signature
- 02Inspect and explain
- 03Create a separate copy
- 04Terminate the writer
- 05Reopen and verify before save
QUESTIONS, ANSWERED
Know the boundary before you clean.
No vague “100% clean” claim.
Are my files uploaded?
No. The cleaner runs in your browser, has no upload endpoint, and only enables the file picker after its processor assets are available locally.
Is the original file changed?
No. KillMetadata reads the original and creates a separately named cleaned copy. It never overwrites the source file.
What does verified-clean mean?
It means no supported privacy metadata remains and the active verifier reported full coverage. It is intentionally not a claim about visible content, steganography or filesystem attributes.
What does partial mean?
Supported privacy fields were removed, but an unknown, unsupported or incompletely inspected carrier remains, or replacement text intentionally remains as metadata. Saving requires explicit confirmation.
Runs locally in your browserReady to inspect your file?
Inspect this file type The picker opens only after offline protection is active.