Photos carry GPS coordinates and camera serial numbers. PDFs carry author names, organisation names, and editing timestamps. Word documents carry all of that plus the editing sessions they were written in, and the photographs pasted into them arrive with their own GPS still attached. None of it is visible in a normal viewer, and all of it survives to publication. strypt finds it and strips it out.

A single self-contained binary. Memory-safe Rust. No network access in any code path.

Status: 0.2.0. No external audit. 0.1.1 and earlier could drop a page from a PDF whose page tree named one object twice, and 0.1.0 left the Exif of photos inside PDFs; see CHANGELOG.md. Read docs/KNOWN_LIMITATIONS.md before relying on strypt. Phases 0–5 are complete: binaries, a Homebrew tap and crates.io, with install steps tested on fresh CI runners, and a desktop app tried by non-technical people on macOS and Linux (docs/ROADMAP.md).

Drop files onto the window, and strypt writes a cleaned copy beside each one and shows what it removed. It uses the same library as the command line.

Download from the latest release:

The first time you open it:

• macOS: drag strypt into Applications and open it. When macOS says it could not verify it, go to System Settings → Privacy & Security, scroll down, and click Open Anyway. Only once.
• Linux: right-click the file, choose Properties, and allow it to run as a program (Allow executing file as program on Ubuntu 22.04). Then double-click it.
• Windows: at SmartScreen, click More info, then Run anyway. Smart App Control may block it outright.

To check a download, use SHA256SUMS and gh attestation verify as in the command line's steps.

Photographs inside a document are stripped by the image handlers (in a PDF, JPEGs only). Every other format is reported as unsupported and never passed through. What each handler removes, keeps, and refuses: docs/THREAT_MODEL.md §7.

For other formats, use mat2 or ExifTool: both mature, actively maintained, and covering far more formats. Where mat2 is the better tool for a file strypt does support, docs/KNOWN_LIMITATIONS.md says so.

1. Rename the file. strypt keeps the name you gave it, plus .stripped.
2. Look at what is visible: faces, screens, reflections, street signs, and the text itself.
3. Check the stripped copy with strypt show, and read what strip said it kept.
4. Upload only the stripped copy. A platform may store the file you send even when it shows a re-encoded one.

If strypt calls a file clean and it still carries metadata, that is a security vulnerability. Report it privately through SECURITY.md, not in a public issue.

For scripts, batches and servers, and on Tails and Qubes-Whonix.

_{A synthetic test photo from corpus/; its GPS, serial number and author are invented.}

Through Homebrew, on macOS or Linux:

brew install fadehack/strypt/strypt

Or download the binary. It is one file, with nothing else to install.

F=strypt-0.2.0-x86_64-unknown-linux-musl    # your file from the table
curl -LO https://github.com/FadeHack/strypt/releases/download/v0.2.0/$F
curl -LO https://github.com/FadeHack/strypt/releases/download/v0.2.0/SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing     # must print "<file>: OK"; older macOS: shasum -a 256 -c
chmod +x $F && ./$F --version                # then rename it strypt, in a directory on your PATH

To check that this repository's CI built it, with the GitHub CLI signed in: gh attestation verify $F -R FadeHack/strypt. On Windows, compare Get-FileHash strypt-0.2.0-x86_64-pc-windows-msvc.exe with its line in SHA256SUMS.

The binaries are not code-signed (ADR-0051). On macOS, a file downloaded in a browser is blocked once: click Open Anyway in System Settings → Privacy & Security. Windows may show SmartScreen, and Smart App Control may block the file outright. Never turn Gatekeeper off to run it.

Tails and Qubes-Whonix: use the static Linux x86_64 binary (ADR-0052). Tails already includes mat2 and Metadata Cleaner, which cover more formats than strypt.

From source: cargo install strypt, with Rust 1.95 or later.

strypt show photo.jpg                  # report what metadata is present; changes nothing
strypt strip photo.jpg                 # write a sanitised copy beside the original
strypt strip --output-dir out/ *.pdf   # write copies elsewhere
strypt strip --in-place report.docx    # overwrite the original (opt-in, never the default)
strypt show --json --recursive ./docs  # machine-readable output for scripting

A failure is loud: a file strypt cannot fully process produces no output. Commands and exit codes: INSTRUCTIONS.md.

show exits non-zero when anything is left to deal with, so a publishing script or CI job can refuse to ship metadata:

strypt show --recursive public/images > /dev/null   # 1: metadata found; 4: a file strypt cannot check

Evidence, not an audit: each point links to where it is checked.

• It fails closed. A file strypt cannot fully process produces no output, and an unsupported format is reported as unsupported, never passed through.
• It re-reads its own output. Every stripped file is detected and inspected afresh, and discarded (exit 5) if anything the handler recognises survived. That proves consistency, not omniscience (docs/THREAT_MODEL.md §4.8).
• It cannot phone home. CI rejects any dependency that can open a network connection, transitive ones included, and proves that check fails on every push (ADR-0004).
• No unsafe in strypt's own code, enforced by the compiler; dependencies are checked against RustSec advisories on every push and weekly.
• Every parser is fuzzed. 19 of 22 fuzz targets meet the bar of 24 CPU-hours with saturated coverage (ADR-0044); jxl, pdf and png do not yet. All 22 run for a minute on every push.
• Every format is compared against mat2 and ExifTool, and each difference is recorded as a bug or a deliberate choice (docs/THREAT_MODEL.md §7).

• It does not redact. A PDF with a black box drawn over text still contains that text.
• It does not change what your document says, or anonymise your writing style.
• It does not clean filenames, and budget_final_jsmith_home.pdf identifies you regardless.
• It does not protect against metadata a platform adds after you upload.
• It cannot defeat fingerprinting. Encoder quirks and camera sensor noise can identify a device from pixel data alone, with no metadata present at all.
• No tool can guarantee complete metadata removal from complex formats. strypt will never claim otherwise.

Dual-licensed under MIT or Apache-2.0, at your option. Contributions are accepted under the same dual licence, per the Apache-2.0 contribution clause, unless you state otherwise.