You stripped the EXIF from your photo before sharing it. GPS gone, camera model gone, timestamps gone. Then you open the same file in an XMP viewer and find something unexpected: the original raw filename, the software that touched it, a list of document ancestors, and sometimes the full develop settings from your Lightroom catalog. Photoshop and Lightroom don't just edit pixels. They write their own metadata layer, and it survives most cleanup routines that only target EXIF.
What Photoshop writes into a file
Every Photoshop save adds an XMP packet, a block of XML metadata that lives alongside the image data. The basics are harmless: CreatorTool names the software and version, and dates record when the file was created and modified. Two entries go further.
The first is xmpMM:DocumentID and xmpMM:InstanceID. Each document gets a unique identifier when it's created, and a new one on every save. This is what the Content Credentials system uses to track provenance, and it's how a platform can tell that two uploads are derived from the same original even after both were "cleaned".
The second is stRef:DocumentAncestors. In older Photoshop versions, files carried a list of every document the current file descended from, including original filenames. Export a derivative, and the ancestor list told anyone who cared what the source file was called. A picture named IMG_4271.NEF or Client_Mockup_v3_FINAL.psd says something. Adobe trimmed this behavior after researchers showed how much it leaked, but files edited in those versions still carry the lists, and plenty of old files are still in circulation.
Photoshop also stores text layer content, layer names, and blend settings in the PSD format itself. Flatten the file to JPEG and those go away, but PSDs shared for review keep the layer names you typed: "invoice_fix", "legal_approved_v2", "remove_ceo".
What Lightroom embeds on export
Lightroom is more interesting, because its default export keeps more than most people expect. Unless you tick Minimize Embedded Metadata, an exported JPEG carries the crs: namespace, the Camera Raw Settings block. It records your develop choices: exposure compensation, contrast, tone curve, clarity, the preset you applied, the camera profile, and the crop. Anyone with a metadata viewer can see that you pushed exposure by 1.7 stops and cropped 20 percent off the frame.
Two fields deserve special attention. Crs:RawFileName holds the original filename of the source file, so a photo exported as sunset_final.jpg reveals it started life as _DSC8814.ARW. And when you export a virtual copy or an edited derivative, the XMP can chain back through the catalog history.
The Minimize Embedded Metadata checkbox strips the develop settings and most XMP, keeping only your copyright and contact information if you set it. it's the single most useful setting in the export dialog, and it's off by default.
Save for Web isn't enough
The classic advice is to use Photoshop's Save for Web or Export As, which drop most metadata. That handles EXIF and most of the XMP, and for many years it was good enough. Today it leaves two problems. First, the tools also rewrite the file in ways that are themselves a fingerprint, and researchers have shown that both Save for Web and social platform re-encodings leave identifiable traces in the JPEG tables. Second, the platforms you upload to now add their own layer: C2PA manifests, platform IDs, and sometimes AI-generation labels that follow the file through re-shares. Cleaning your side of the transaction matters, but so does knowing what the receiving side adds.
How to see what's actually in your file
don't trust a single viewer. The fastest honest check is ExifTool, the same tool we recommend for reading photos:
Exiftool -a -u -G1 filename.jpg
The -u flag pulls unknown tags, and -G1 groups them by family, so the XMP block shows up separately from EXIF and the Photoshop block separately from both. For the specific leaks discussed here:
Exiftool -XMP:All -Photoshop:All filename.jpg
If you want the full picture of what Lightroom kept, look for anything starting with Crs. you'll usually find a few dozen fields.
How to remove it
For one file before sending, Export As with metadata set to None, or Save for Web, removes the XMP along with the EXIF. For files already exported, ExifTool strips just the editing layer without touching the pixels:
Exiftool -XMP:All= -Photoshop:All= -Crs:All= filename.jpg
Note that this doesn't remove the basic file structure identifiers (DocumentID and InstanceID stick around because they're part of the XMP media management block). If you want those gone too, remove the entire XMP block:
Exiftool -XMP:All= filename.jpg
Keep a copy before you strip anything. Deleting XMP is irreversible, and if the file is a deliverable the client may ask for the intact version later.
The habit that matters
Most people reading this will share files through a chat app, a cloud drive, or a marketplace, and each of those has its own policy about what gets stripped and when. Messaging apps mostly re-encode and drop metadata, but not always completely and not for every format. Cloud drives keep the original file intact, which is what you want for delivery and what you don't want for a public share. The rule that holds across all of them: run the export through one deliberate cleanup step, check it with a viewer or ExifTool, and then send.
If you want the numbers on how much a JPEG can carry, we went through the EXIF fields themselves in a previous guide. For files that arrive from others, reading them before you forward is the same skill in reverse. And if you edit on an iPhone first, the HEIC to JPEG conversion adds its own quirks.