# Discord image privacy: what survives an upload?

- Canonical: https://creatorprivacykit.com/blog/discord-image-privacy-exif-metadata
- Reviewed: 2026-09-15
- Category: Privacy field note
- Author: CreatorPrivacyKit Research

“Discord strips EXIF” is too broad to be useful. The practical question is what happened to the exact file, client, and upload path you used.

There are also two different things people often mix together:

1. What Discord receives at upload time.
2. What another user later downloads.

A downloaded attachment can answer the second question. It does not prove everything about the first.

## A five-minute test

Choose a non-sensitive photo with known metadata and record:

- SHA-256
- dimensions
- byte size
- EXIF
- XMP / IPTC
- ICC profile
- any provenance data you care about

Upload it to a private test channel, download the resulting attachment, and repeat the measurements.

## How to read the result

| Observation | Reasonable conclusion | Do not jump to |
| --- | --- | --- |
| SHA-256 changed | The delivered bytes differ from the source | “Discord removed only metadata” |
| Dimensions changed | The delivered image was resized | A claim about internal storage |
| EXIF disappeared | The downloaded copy no longer contains those fields | “Discord never received the EXIF” |
| Hash stayed identical | That route delivered the same bytes in that test | A permanent guarantee across every client and format |

## Why blanket claims age badly

Media handling can vary with file type, client, size, upload route, and platform updates. A statement like “Discord always strips all metadata” can be true for one observed path and false for another.

A reproducible test is more useful than platform folklore.

## About AI-image metadata

PNG, JPEG, and other image containers can carry text chunks, XMP, provenance manifests, or application-specific metadata. Whether a particular Midjourney or other generated file contains prompts, seeds, job IDs, C2PA data, or none of those fields depends on the file you actually downloaded.

Inspect the file instead of assuming a generator always embeds a particular field.

## Privacy recommendation

If GPS coordinates, camera identifiers, authoring data, or prompt-related metadata are sensitive, remove them before upload. Keep the original locally and share a sanitized copy.

That changes the problem from “what does Discord do?” to “what is in the file I am sending?” — a question you can answer yourself.

## CreatorPrivacyKit

CreatorPrivacyKit can inspect and sanitize supported files locally in the browser. The tool does not need to claim what Discord stores internally in order to be useful.