An SVG is not a compiled image, it is XML text you can open in any editor, and it leaks accordingly. It can carry the author's local export path with their username, the exact vector editor and version that made it, Dublin Core creator and licence details, external references that act as trackers, and scripts that run when the file is opened in a browser. A raster image embedded inside it keeps its own EXIF and GPS on top of all that.
Scan a SVG fileThe most direct leak is a local path. Inkscape writes the document name and Illustrator writes an export filename into namespaced attributes, and those often contain the full local path, which exposes the account username and the folder layout of the machine that made the file. The editor identifies itself too: Inkscape stamps a version attribute, and Illustrator, Figma, Sketch and the icon-font exporters leave a generator comment naming the exact application and version, which fingerprints the design tooling behind the graphic.
The metadata block carries authorship and rights. A scan reads the Dublin Core creator, contributor, publisher, and source (what the graphic was traced or derived from), plus a Creative Commons licence written as an rdf:resource URL that a plain text search would miss. Timestamps from the XMP edit history record each save, and the xmpMM document and instance identifiers link this file back to the original artwork it came from even when nothing visible does.
SVG is an active-content surface. A script element or an on-event handler attribute makes the file executable when it is opened in a browser, which is a genuine security risk and is flagged as such. External references via href or xlink:href can point to remote URLs that behave as trackers or pull in content when the file opens, or to file:// and UNC paths that reveal internal infrastructure or a username.
A raster embedded as a data: URI is a file within the file. A JPEG or PNG placed inside an SVG keeps its own EXIF, GPS and camera identity, and stripping the SVG's own metadata never touches it. This scanner decodes those embedded images and reads their metadata as well, so a location baked into a photo dropped into the graphic does not slip past.
This is a selection. The full field manual documents the fields read from each format.
An SVG can contain executable script, either in a script element or in on-event handler attributes, and that code can run when the file is opened in a browser. That makes SVG an active-content format rather than a static picture, which is why a scan flags embedded scripts as a security risk.
Often, yes. It can carry a local export path that includes the author's username and folder layout, a Dublin Core creator name, and a generator comment naming the exact editor and version. Together these can identify both the person and the design tools they used.
It can. External href references to remote URLs can behave as trackers or pull in remote content the moment the SVG is displayed, similar to a tracking pixel in an email. References to local or network paths can also leak details of internal infrastructure.
No. A raster image embedded as a data: URI keeps its own EXIF, GPS and camera identity, and that lives independently of the SVG's own metadata. You have to clean the embedded image itself, which is why this scanner reads inside those embedded rasters too.
File X-Ray inspects an SVG but does not modify it. Because an SVG is plain text, you can open it and delete the metadata block, any script or on-event attributes, and editor-specific namespaced attributes, or run it through an SVG optimiser that strips editor metadata, then scan it again to confirm nothing identifying remains.
File X-Ray reads SVG files entirely in your browser - the file never leaves your device. For this format you can also download a clean copy with the metadata removed. Scan a file now.