- Fields classified as private or descriptive by the active format engine
- Artwork and thumbnails under the privacy-default profile
- Original metadata structures that can survive a superficial edit
METHODOLOGY
How local metadata cleaning works
Trust should come from an inspectable process, not a vague “clean” badge. KillMetadata follows the same sequence for every supported file: identify, inspect, plan, rewrite and independently verify.
THE CLEANING PLAN
Remove what exposes you. Keep what makes the file work.
Every field is shown before the rewrite and classified by action and coverage.
- Functional data required for correct display or playback
- Structural data required for file validity
- The source file itself
- Explicitly required fields such as EPUB language and identifier
- Visible-content redaction
- Steganography detection
- Secure deletion of the source
- Filesystem attributes outside the browser File object
WHY THE ENGINE MATTERS
Five bounded phases, isolated worker lifetimes
The scanner identifies a file from its bytes and internal structure. It emits logical fields with their native carrier, privacy class, risk, editability and coverage. A clean plan is then expressed as bounded copy, write and zero operations or a format-specific structural rewrite.
The original is never modified. Scan, rewrite, and verification run in separate dedicated-worker lifetimes; each task worker is terminated after its phase. The verifier reads the output from bytes and produces verified-clean, partial or rejected. File bytes and reports are not persisted to Cache Storage, IndexedDB or localStorage.
Explore the complete verification methodology →BEFORE YOU SHARE
A four-step privacy check.
Metadata cleaning is one part of a safe sharing workflow.
- 01Identify by signature
- 02Inspect and explain
- 03Create a separate copy
- 04Terminate the writer
- 05Reopen and verify before save
QUESTIONS, ANSWERED
Know the boundary before you clean.
No vague “100% clean” claim.
Are my files uploaded?
No. The cleaner runs in your browser, has no upload endpoint, and only enables the file picker after its processor assets are available locally.
Is the original file changed?
No. KillMetadata reads the original and creates a separately named cleaned copy. It never overwrites the source file.
What does verified-clean mean?
It means no supported privacy metadata remains and the active verifier reported full coverage. It is intentionally not a claim about visible content, steganography or filesystem attributes.
What does partial mean?
Supported privacy fields were removed, but an unknown, unsupported or incompletely inspected carrier remains. Saving requires explicit confirmation.
Runs locally in your browserReady to inspect your file?
Inspect this file type The picker opens only after offline protection is active.