Methodology

Tested product scope

Last automated review: 2026-08-03. JPEG and PNG are supported. WebP is feature-detected. HEIC and HEIF are decoded by a self-hosted browser module and cleaned to JPEG. AVIF, GIF, TIFF, BMP, SVG, RAW, PDF, and video are rejected.

The results above use Playwright-bundled browser engines. Behavior can differ in installed stable browsers, real devices, and assistive technologies.

Validation and inspection

• Checks filename extension, reported MIME type, and JPEG/PNG/WebP/HEIC/HEIF signatures. AVIF remains rejected even though it also uses an ISO base media container.
• Rejects files above 25 MB, batches above 20 files or 150 MB, and decoded images above 60 megapixels.
• Uses exifr 7.1.3 together with local PNG, WebP, and HEIF container readers. HEIF EXIF is located inside the container and parsed locally; WebP EXIF/XMP/ICC and PNG zTXt/non-XMP iTXt are also inspected.
• Renders all extracted values as text and masks serial-like values by default.

Processing model

The metadata cleaner uses a Web Worker with createImageBitmap and OffscreenCanvas in supported browsers. Browsers without OffscreenCanvas use a sequential HTML canvas fallback. The original file is decoded with displayed orientation, drawn to a new canvas, and re-encoded. JPEG and WebP are lossy; PNG is also regenerated and may change profile behavior.

HEIC and HEIF pixels are decoded by the self-hosted @discourse/heic WebAssembly module only after such a file is selected. Cleaner, cropper, and redaction output is JPEG; auxiliary images, depth maps, and Live Photo video are not copied. Large HEIC batches can use substantial device memory.

During compression, each file is decoded once and files are processed sequentially. JPEG and WebP use a capped quality search. Resolution reduction begins only when the minimum quality is still above the target and the user has enabled resizing. PNG does not use a quality value and is never changed to another format automatically. Every search has fixed quality and resize attempt limits.

Verification

The output Blob is parsed with the same metadata adapter. A result is downloadable only when no readable private or descriptive category remains. Technical dimensions may still be readable. This approach does not establish forensic cleanliness or anonymity.

Fixtures and automated checks

• Original project fixtures include metadata-bearing JPEG, PNG, WebP, and HEIC files, EXIF UserComment, PNG zTXt/iTXt, clean images, an orientation sample, and a corrupt image.
• Unit tests cover signatures, limits, naming, classification, masking, routes, quality settings, target parsing, bounded quality and resolution search, reducer transitions, and verification.
• Playwright tests exercise upload, inspection, cleaning, target-size compression, output-size enforcement, download, ZIP, cancellation, errors, localization, legal routes, mobile layout, axe checks, and the no-upload network rule.
• The fixture-generation method and the checks used to validate the published results are described below. MetaRinse repeats these checks during development and before release.

How the published fixture evidence is reproduced

• The fixture generator creates JPEG, PNG, WebP, and HEIC files from project-owned pixel data and inserts harmless markers for GPS, device, date, creator, comment, EXIF, XMP, zTXt, and iTXt coverage.
• Unit tests parse the original bytes and assert the expected categories, masked serial behavior, standard JPEG comments, PNG compressed and international text, and WebP EXIF/XMP fields.
• Playwright selects each fixture through the real file input, runs the same browser processing used by visitors, downloads the result, and parses the downloaded bytes again.
• The JPEG check verifies 32 × 24 dimensions and a bounded mean RGB difference. The PNG check verifies 24 × 18 dimensions plus translucent and opaque alpha samples. The WebP check verifies a 4 × 3 image and its alpha sample.
• A separate network test watches requests after file selection and fails if it detects a filename, known marker, image signature, base64 payload, or image-bearing request.

Known limitations

• Vendor-specific metadata may not be understood by exifr.
• Canvas re-encoding can change compression, file size, color profiles, and subtle pixel values.
• Visible information, filenames, cloud copies, file-system dates, and platform account records are outside the metadata scanner.
• Low-memory devices may require smaller batches.
• WebP encoding depends on the browser.
• Inflated PNG compressed-text metadata is capped at 2 MB; malformed or larger text chunks are rejected instead of being treated as empty.

Security reporting

Report a reproducible security or privacy issue to metarinse@gmail.com. Do not include private photos, metadata, credentials, or sensitive personal information in the report.