The visible content of a file is often the least revealing part of it. A photo can carry the exact GPS coordinates of where it was taken. A Word document can carry the real name behind a pseudonymous byline in its author field. Even an ordinary file downloaded through Safari carries, invisibly, the exact web address it came from. None of this requires anyone to hack you — it is metadata, sitting in the file or attached to it by macOS, and it is often only a couple of terminal commands away from being read by whoever you send that file to.
EXIF and GPS in photos: the classic case
Most photos taken on a phone or a digital camera carry EXIF data: the camera model, the exact time the shutter opened, and — if location services were on — the precise latitude and longitude. This is not a hypothetical risk. In December 2012, a photograph of the software entrepreneur John McAfee, taken by a journalist accompanying him at a Guatemalan resort while he was evading Belizean authorities, was published still carrying its original EXIF GPS metadata, which revealed his exact location to anyone who looked at the file rather than just the picture.
You can inspect and strip this yourself with ExifTool, a widely used command-line tool for reading and writing metadata across image, video and document formats.
# See everything embedded in a photo, including GPS coordinates
exiftool photo.jpg
# Remove every metadata field (creates photo.jpg_original as a backup)
exiftool -all= photo.jpg
# Remove only GPS data, keeping other EXIF fields intact
exiftool -gps:all= photo.jpg
# Strip metadata from every JPEG in a folder
exiftool -all= -r ~/Pictures/ToSend/On a Mac, Preview’s Tools menu also has an Inspector that shows a photo’s embedded information without a terminal, and both Photos and Preview let you export a copy without location data — useful for a single photo, though ExifTool is the more reliable choice when you need to confirm every field is actually gone, since app export options do not always document exactly what they strip.
PDF and Office document metadata
Documents carry their own, less visible metadata: an author name, the company name entered when the software was installed, the application and version used to create the file, and, in Word documents especially, a revision history that can include text you thought you had deleted or comments you meant to remove before sharing. Microsoft’s own support documentation describes its Document Inspector tool, built into Word, Excel and PowerPoint, as capable of finding and removing author names, tracked-change history, comments, hidden text and document properties such as title and company — while warning that it should be run on a copy, since some of what it removes cannot be restored afterward.
ExifTool reads and strips PDF and Office metadata too, which is useful when you want one consistent tool and workflow instead of switching between each app’s own privacy feature.
# See a PDF's author, producer and creation software
exiftool report.pdf
# Strip PDF metadata
exiftool -all= report.pdf
# Same for a Word document
exiftool -all= contract.docxmacOS’s own hidden metadata: extended attributes
Independently of what a photo or document embeds, macOS itself attaches metadata to files through extended attributes — small key-value records stored alongside a file by the filesystem, invisible in Finder’s normal view. The one most worth knowing about is com.apple.metadata:kMDItemWhereFroms, which Safari and other apps write automatically to record the exact URL a file was downloaded from, along with the referring page. Forward a downloaded PDF to someone without knowing this exists, and you may be handing over the exact internal link, private cloud-storage URL, or leak site it came from.
# List every extended attribute on a file, with values
xattr -l report.pdf
# Show only the source-URL attribute, if present
xattr -p com.apple.metadata:kMDItemWhereFroms report.pdf
# Remove it
xattr -d com.apple.metadata:kMDItemWhereFroms report.pdf
# Strip every extended attribute from a file
xattr -c report.pdfSpotlight metadata: what mdls reveals
Spotlight, macOS’s search index, keeps its own metadata database about most files on disk, queryable with the mdls command — separate from a file’s embedded metadata or its extended attributes, but capable of revealing similar things, including which app or device created a file.
# Show every Spotlight metadata attribute for a file
mdls photo.jpg
# Show just one attribute — the app that created it
mdls -name kMDItemCreator photo.jpg
# Find every camera model used across your photo library
mdfind -0 kind:image | xargs -0 mdls -name kMDItemAcquisitionModel | sort -uA tool built for this specific job: mat2
mat2, the Metadata Anonymisation Toolkit, was built specifically to strip metadata across a wide range of common file formats from one command-line tool, aimed at journalists and activists who need to be sure a file is clean before sending it. It is worth knowing that the original project repository is now archived and no longer actively maintained, so treat it as one option among several rather than the only one — for most people on a Mac today, ExifTool plus a manual check with xattr -l covers the same ground and is more actively kept up to date.
Building the habit
None of this is complicated once it is a habit: check a file with exiftool and xattr -l before you send it, not after someone points out what was in it. The pattern across every case above — a photo, a Word document, a downloaded PDF — is the same: the file’s visible content was never the problem. What travelled with it, invisibly, was.
How FireAI and HisnLabs fit in
Metadata stripping is not something FireAI does — it is a network firewall, not a file-hygiene tool — but the tools below run entirely on your own Mac too, so cleaning up a file before you send it never has to leave your machine any more than FireAI’s own on-device connection review does.
FireAI is HisnLabs’ own product: an on-device AI firewall for Mac. It shows every connection your apps make, in plain language, and lets you decide what leaves your Mac — its AI runs locally, so your traffic is never sent to us or anyone else. HisnLabs’ security research team is the group that keeps that decision-making accurate: cataloguing which domains are ordinary telemetry versus a real product, tracking the country and network behind a connection, and training the on-device model (its Autopilot feature) on real traffic patterns, all without any of it leaving your Mac.
You can read the technical decisions behind it, or try FireAI for 17 days, at FireAI, by HisnLabs.