Checking SVG metadata

SVG files are text/XML and may retain comments, layer names, IDs, hidden text, tool information, filenames, and visible clues.

SVG is an image file, but its contents are text.

Unlike images that look like PNG or JPEG, an SVG file may retain shapes, text, comments, layer names, tool information, IDs, descriptions, and similar information as XML.

Even if nothing appears wrong visually, when you open the file as text, the author name, company name, project name, original text, or editing tool information may remain.

If you publish an image or diagram anonymously, you need to check SVG not as an "image," but as a "text file that will be published."

This article organizes what kinds of information remain in SVG and what to check before publication.

SVG is an image whose contents can be read

SVG stands for Scalable Vector Graphics. It is a format that represents vector images in XML.

Circles, lines, text, paths, colors, positions, and similar elements are written as tags and attributes. For that reason, SVG can be displayed as an image in a browser, while its contents can also be read in a text editor.

The danger of SVG is that appearance and contents do not match.

Text you thought you removed on screen may remain inside the XML.

Design tool information remains

SVG is often exported from design tools or diagramming tools.

At that time, the creation tool name, export settings, layer names, object names, and template names may remain.

The tool name alone may not always be a major problem.

However, if a company name, school name, project name, internal term, or user name remains, it directly affects anonymity.

Be careful with hidden text

In SVG, invisible text or text that is too small may remain.

For example, if a name from the original diagram was only moved off screen, made transparent, or placed on a hidden layer, the text may remain inside the XML.

Even if the image looks problem-free, check the contents as text.

For SVG that requires anonymity, it is important not to publish based only on visual review.

What to check

Before publishing SVG, check the following information.

The checking method is simple.

Open the SVG file in a text editor and search for names, email addresses, company names, school names, project names, place names, comments, and unnecessary strings.

How to treat SVG optimization tools

SVG has optimization tools for removing unnecessary metadata and attributes.

SVGO is a representative tool for optimizing SVG files. In the official repository, you can check what it removes and what plugins are available.

URL : https://github.com/svg/svgo

When using SVGO, think of it as an official local tool for processing. If you upload a high-risk SVG to an SVG optimization service on the web, strings inside the XML and the filename may be sent to an external service.

However, running a tool does not necessarily make the file safe.

What remains changes depending on settings. What the tool removes is mainly unnecessary attributes and metadata. It does not judge text, backgrounds, or meaning that are originally drawn inside the image.

Even when using SVGO, a human ultimately checks the contents.

Is converting to PNG safe?

If you convert SVG to a raster image such as PNG, text information as XML will generally no longer appear.

However, that does not make it completely safe.

Text displayed as an image, backgrounds, logos, maps, and screen information remain. The converted image file may also receive separate metadata.

Conversion is one useful option.

However, after conversion, check both the appearance and the file information.

Practical steps before sharing

Before publishing SVG, use a fixed procedure to check it.

First copy the original file and create a separate file for publication. Next, open the contents in a text editor and search for names and organization names. After that, display it in a browser and check for remaining visible text and logos. Finally, check whether the publication filename contains personal information.

Using the same procedure every time reduces missed checks.

The more rushed you are, the more important it is not to judge by appearance alone.

Reconsider the publication format for high-risk SVG

For whistleblowing, reporting materials, diagrams related to workplaces or schools, and diagrams where people involved need protection, consider whether publishing as SVG is necessary.

SVG is convenient, but because it includes an editable structure, it is a format where information tends to remain. If readers do not need to zoom or edit the file, converting it to PNG and then checking it as an image is also an option.

However, even after PNG conversion, backgrounds and displayed text remain.

Changing the format is not a choice for reducing checks. It is a choice for changing the type of information you need to check.

Summary

SVG is displayed as an image, but its contents are text.

Author names, company names, school names, layer names, IDs, comments, hidden text, and work notes may remain.

When publishing SVG anonymously, check not only the image appearance, but also the contents in a text editor.

Optimization tools such as SVGO are useful, but do not leave judgment to the tool.

Ultimately, it is important to check the text content, image appearance, XML contents, and filename together.

Related tools

Related articles

• Metadata —Hidden text and XML comments
• Metadata —SVGO and manual XML checks
• Metadata —Removing image metadata
• Metadata —How Images Can Break Anonymity
• Metadata —Risk of Identity Inference From Backgrounds, Reflections, and Text in Images
• Metadata —Metadata left in submissions and file sharing