SVG metadata
How to remove metadata from an SVG
An SVG is text, and the program that saved it writes more than the drawing: the name the file was saved as, where it was exported to on your computer, who made it, sometimes a whole second copy of the drawing. None of it is drawn, and all of it goes wherever the logo or icon goes — onto a website, into a repository, to a client. hexscope shows it and saves a copy without it, in your browser. The file is not uploaded anywhere.
Check a drawing Try an Inkscape drawing
1 What an SVG can keep
- Inkscape's own attributes: the name the drawing was saved as, the folder it was last exported to — older versions keep the whole path, with the user's folder — its version, and the size and place of the window it was edited in.
- Metadata: what Document Properties → Metadata holds — the creator, publisher, title, date, description and keywords.
- A comment naming the program, as Illustrator and Sketch write at the top.
- Illustrator's own copy of the drawing, kept when Preserve Illustrator Editing Capabilities is on: it can hold layers, hidden objects and artboards the SVG does not show.
- Pictures linked by their path on your computer, and photos embedded in it, each with its own EXIF: where it was taken, with which camera.
The sample poster was exported to a folder under /home/olena.koval/Work/Acme and carries a photo that still says it was taken at the Eiffel Tower.
2 Remove it
Open the drawing in hexscope and press Remove it — save a clean copy. In the copy:
- the metadata, Inkscape's attributes and settings, the comment naming the program and Illustrator's own copy are left out;
- a linked picture keeps only its file name, not the folders before it;
- a photo inside is cleaned as a photo of its own, and put back;
- the shapes and text are copied as they are.
Then press Open the clean copy, and hexscope says what is gone.
3 Scripts
An SVG can hold scripts. They run when the drawing is opened on its own in a browser, or put in a page as an object — not when a page shows it as a picture. hexscope names them and leaves them in the copy, since they are part of the drawing: if you did not put them there, open the drawing in an editor and look.
4 In the program itself
- Inkscape: empty File → Document Properties → Metadata, and then save it with File → Save a Copy, choosing Plain SVG, which leaves out Inkscape's own attributes but keeps the metadata.
- Illustrator: choose File → Export → Export As → SVG, which does not write Illustrator's own copy; Save As keeps it while Preserve Illustrator Editing Capabilities is on.
- For a website: SVGO's default settings leave out metadata, comments and editors' attributes, but not the EXIF of a photo embedded in the drawing.
Check the result either way: open the saved file in hexscope and see what is left.
5 Before you publish a site
The command line tool and its GitHub Action read every SVG in a folder, and can fail a build when one names a folder on someone's computer:
hexscope check --fail-on links,original,author site/
Check a drawing now Your files never leave your browser.