Photos carry GPS coordinates and camera serial numbers. PDFs carry author names, organisation names, and editing timestamps. Word documents carry all of that plus the editing sessions they were written in, and the photographs pasted into them arrive with their own GPS still attached. None of it is visible in a normal viewer, and all of it survives to publication. strypt finds it and strips it out.

A single self-contained binary. Memory-safe Rust. No network access in any code path.

Status: 0.1.2. No external audit. 0.1.1 and earlier could drop a page from a PDF whose page tree named one object twice, and 0.1.0 left the Exif of photos inside PDFs; see CHANGELOG.md. Read docs/KNOWN_LIMITATIONS.md before relying on strypt. Phases 0–4 are complete: binaries, a Homebrew tap and crates.io, with install steps tested on fresh CI runners (docs/ROADMAP.md).

_{A synthetic test photo from corpus/; its GPS, serial number and author are invented.}

Formats

Kind	Formats
Images	JPEG, PNG, WebP, TIFF, GIF, HEIF/AVIF (.heic, .heif, .avif), SVG, JPEG XL
Documents	PDF; Office Open XML (.docx, .xlsx, .pptx); OpenDocument (.odt, .ods, .odp)
Audio and video	FLAC, WAV, MP3, Ogg (.ogg, .opus, .oga), MP4/M4A (.mp4, .m4v, .m4a, .m4b)

Photographs inside a document are stripped by the image handlers (in a PDF, JPEGs only). Every other format is reported as unsupported and never passed through. What each handler removes, keeps, and refuses: docs/THREAT_MODEL.md §7.

For other formats, use mat2 or ExifTool: both mature, actively maintained, and covering far more formats. Where mat2 is the better tool for a file strypt does support, docs/KNOWN_LIMITATIONS.md says so.

Why trust the output

Evidence, not an audit: each point links to where it is checked.

• It fails closed. A file strypt cannot fully process produces no output, and an unsupported format is reported as unsupported, never passed through.
• It re-reads its own output. Every stripped file is detected and inspected afresh, and discarded (exit 5) if anything the handler recognises survived. That proves consistency, not omniscience (docs/THREAT_MODEL.md §4.8).
• It cannot phone home. CI rejects any dependency that can open a network connection, transitive ones included, and proves that check fails on every push (ADR-0004).
• No unsafe in strypt's own code, enforced by the compiler; dependencies are checked against RustSec advisories on every push and weekly.
• Every parser is fuzzed. 19 of 22 fuzz targets meet the bar of 24 CPU-hours with saturated coverage (ADR-0044); jxl, pdf and png do not yet. All 22 run for a minute on every push.
• Every format is compared against mat2 and ExifTool, and each difference is recorded as a bug or a deliberate choice (docs/THREAT_MODEL.md §7).

What strypt will not do

• It does not redact. A PDF with a black box drawn over text still contains that text.
• It does not change what your document says, or anonymise your writing style.
• It does not clean filenames, and budget_final_jsmith_home.pdf identifies you regardless.
• It does not protect against metadata a platform adds after you upload.
• It cannot defeat fingerprinting. Encoder quirks and camera sensor noise can identify a device from pixel data alone, with no metadata present at all.
• No tool can guarantee complete metadata removal from complex formats. strypt will never claim otherwise.

Before you publish

1. Rename the file. strypt keeps the name you gave it, plus .stripped.
2. Look at what is visible: faces, screens, reflections, street signs, and the text itself.
3. Check the stripped copy with strypt show, and read what strip said it kept.
4. Upload only the stripped copy. A platform may store the file you send even when it shows a re-encoded one.

If strypt calls a file clean and it still carries metadata, that is a security vulnerability. Report it privately through SECURITY.md, not in a public issue.

Install

Homebrew, on macOS or Linux:

brew install fadehack/strypt/strypt

Or download the binary. It is one file, with nothing else to install.

Platform	File
Linux x86_64 (static)	strypt-0.1.2-x86_64-unknown-linux-musl
Linux arm64 (static)	strypt-0.1.2-aarch64-unknown-linux-musl
macOS, Apple Silicon	strypt-0.1.2-aarch64-apple-darwin
macOS, Intel	strypt-0.1.2-x86_64-apple-darwin
Windows x86_64	strypt-0.1.2-x86_64-pc-windows-msvc.exe

F=strypt-0.1.2-x86_64-unknown-linux-musl    # your file from the table
curl -LO https://github.com/FadeHack/strypt/releases/download/v0.1.2/$F
curl -LO https://github.com/FadeHack/strypt/releases/download/v0.1.2/SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing     # must print "<file>: OK"; older macOS: shasum -a 256 -c
chmod +x $F && ./$F --version                # then rename it strypt, in a directory on your PATH

To check that this repository's CI built it, with the GitHub CLI signed in: gh attestation verify $F -R FadeHack/strypt. On Windows, compare Get-FileHash strypt-0.1.2-x86_64-pc-windows-msvc.exe with its line in SHA256SUMS.

The binaries are not code-signed (ADR-0051). On macOS, a file downloaded in a browser is blocked once: click Open Anyway in System Settings → Privacy & Security. Windows may show SmartScreen, and Smart App Control may block the file outright. Never turn Gatekeeper off to run it.

Tails and Qubes-Whonix: use the static Linux x86_64 binary (ADR-0052). Tails already includes mat2 and Metadata Cleaner, which cover more formats than strypt.

From source: cargo install strypt, with Rust 1.95 or later.

Usage

strypt show photo.jpg                  # report what metadata is present; changes nothing
strypt strip photo.jpg                 # write a sanitised copy beside the original
strypt strip --output-dir out/ *.pdf   # write copies elsewhere
strypt strip --in-place report.docx    # overwrite the original (opt-in, never the default)
strypt show --json --recursive ./docs  # machine-readable output for scripting

A failure is loud: a file strypt cannot fully process produces no output. Commands and exit codes: INSTRUCTIONS.md.

show exits non-zero when anything is left to deal with, so a publishing script or CI job can refuse to ship metadata:

strypt show --recursive public/images > /dev/null   # 1: metadata found; 4: a file strypt cannot check

Documentation

Document	Contents
docs/KNOWN_LIMITATIONS.md	What strypt keeps, cannot see, and refuses, per format
docs/THREAT_MODEL.md	Adversaries, protections, and limits
docs/PRD.md	Problem, users, requirements, and where strypt differs from mat2
docs/ARCHITECTURE.md	System design, dependencies, security architecture
docs/ROADMAP.md	Phases, deliverables, exit criteria
docs/DECISIONS.md	Architecture decision records
docs/TESTING_STRATEGY.md	How correctness is verified
CONTRIBUTING.md	How to contribute, and how strypt is developed
SECURITY.md	Reporting vulnerabilities
INSTRUCTIONS.md	Build, test, and lint commands

Licence

Dual-licensed under MIT or Apache-2.0, at your option. Contributions are accepted under the same dual licence, per the Apache-2.0 contribution clause, unless you state otherwise.