A .vcf vCard is a contact card, so unlike most files its entire purpose is to carry personal data - but it holds more than the name and number you see in a contacts app. The structured name field can spell out a middle name or title the display name drops, an embedded photo can carry its own metadata, and the free-text note is where people quietly record private context about someone.
Scan a vCard Contact fileThe obvious contents come out first: the full name (FN), every phone number (TEL), every email (EMAIL), one or more postal addresses (ADR), the organisation (ORG) and job title (TITLE). The name, numbers, emails and addresses are flagged as direct high-risk identifiers, and the organisation and title place the person at an employer - together they are what makes a shared vCard so easy to over-share.
The details people forget are in the structured fields. The N property breaks the name into given, family, prefix and suffix, so it can reveal a middle name, an honorific or a suffix the display name leaves out. BDAY carries a date of birth - a sensitive identifier used for verification - and ANNIVERSARY and NICKNAME add more. A REV timestamp records when the card was last revised.
vCards link a person to their other accounts. File X-Ray reads messaging and social handles from IMPP, X-SOCIALPROFILE, X-TWITTER, X-SKYPE, X-JABBER, X-AIM, X-GTALK, X-MSN and X-ICQ - a social handle ties the card to an account on another platform, which is usually easier to search than a phone number. A plain website (URL) is read alongside them.
The quietest fields are the most revealing. The free-text NOTE is where people record private context about someone, and because most contact views never show it, File X-Ray reports it as high risk. An embedded PHOTO is flagged as present because the image can carry its own metadata, and PRODID names the app that generated the file.
This is a selection. The full field manual documents the fields read from each format.
By design, almost all of it: the full name, every phone number and email, one or more postal addresses, a date of birth, the organisation and job title, social and messaging handles, an embedded photo and any free-text note. A vCard exists to carry personal data, so a shared one can hand over a complete identity.
It can. The BDAY property stores a date of birth, and File X-Ray flags it as high risk because a birthday is a sensitive identifier commonly used for identity verification. The card can also carry an anniversary and a nickname.
vCards can store messaging and social account handles in fields like IMPP, X-SOCIALPROFILE, X-TWITTER, X-SKYPE, X-JABBER, X-AIM, X-GTALK, X-MSN and X-ICQ. File X-Ray reads them because a handle links the person to an account on another platform, which is often easier to search than a phone number.
The structured N field can spell out a middle name, an honorific or a suffix the display name drops; the free-text note carries private context most contact apps never show; and an embedded photo can carry its own metadata. File X-Ray surfaces all of these.
Open it in File X-Ray. It parses the card entirely in your browser - the card is never uploaded, though a GEO coordinate on it is sent to draw a map - and lists every field it carries, from phone numbers and addresses to the birthday, social handles and any note, so you can see exactly what you would be handing over. It inspects and identifies the fields rather than rewriting the file for you.
File X-Ray reads vCard Contact files entirely in your browser - the file never leaves your device. This format is inspected, not modified. Scan a file now.