photography
How to Check a Camera's Shutter Count (and Why Canon Won't Tell You)
The shutter count isn't a standard EXIF tag. It sits in each maker's private notes, and only Nikon, Sony and Pentax write one you can decode. Edits and exports erase it.
If you’re buying a used camera, the seller will usually tell you the shutter count, and most guides say you can check it yourself by uploading a photo. That works for some cameras and fails for others without any error. The shutter count isn’t part of standard EXIF. It lives in the manufacturer’s private “maker notes”, each brand stores it differently (in plain form, enciphered, or encrypted), and some brands don’t store it in the file at all. Once you know where the number is kept, it’s clear why a Nikon file gives you an answer, a Canon file usually doesn’t, and a photo sent to you through a messaging app never will.
Every tag number below was checked against ExifTool’s tag tables, the reference decoder that most metadata tools copy. The worked examples are real bytes from our test suite.
Where the number lives: MakerNote, not EXIF
A JPEG’s EXIF block is a small TIFF structure. IFD0 holds the basics like Make (0x010F) and Model (0x0110), and it has a pointer (0x8769) to the Exif IFD, which holds exposure settings. The Exif IFD has one tag that EXIF itself never defines the contents of: 0x927C MakerNote. It’s a blob of bytes that each manufacturer fills with its own format. ExifTool’s makernote catalog lists makernote types for 6,940 camera models from 106 manufacturers. That gives you an idea of how little standardization there is.
So a “shutter count reader” is really a set of separate decoders, one per brand and sometimes one per model family. Our camera shutter count checker follows this path:
JPEG APP1 "Exif\0\0" → TIFF header → IFD0 (Make, Model)
→ ExifIFD (0x8769) → MakerNote (0x927C)
→ brand header ("Nikon\0\x02", "AOC\0", "PENTAX \0", "SONY DSC \0" …)
→ brand-specific tag → decodeFor in-camera Pentax DNGs, and for DNGs converted by Adobe, the maker note is stored under DNGPrivateData (0xC634) instead, so we check there too. That’s why a generic EXIF viewer never shows the count. Our image metadata viewer, for example, reads make and model from IFD0 and follows the 0x8769 pointer into the Exif IFD for exposure, aperture, ISO, and focal length, but it never opens the maker note.
Nikon: tag 0x00A7, stored as plain text
Nikon is the easiest. From the ExifTool Nikon table:
| Tag | Name | Type | ExifTool note |
|---|---|---|---|
| 0x00A7 | ShutterCount | int32u | ”includes both mechanical and electronic shutter activations for models with this feature. This value is used as a key to decrypt other information…“ |
| 0x0037 | MechanicalShutterCount | int32u | — |
A common claim is that “newer Nikons encrypt the shutter count.” That isn’t accurate. Nikon does encrypt several maker-note blocks (ExifTool lists encrypted ShotInfo tables for the D40, D80, D90, D3, D300 and others), but the key for that encryption is the ShutterCount together with the SerialNumber (tag 0x001D, which carries the same “used as a key” note). The count itself has to be stored in the clear, because otherwise the camera’s own software couldn’t decrypt anything. The one special value is 4294965247, which ExifTool’s Nikon.pm prints as “n/a”. We treat it the same way.
The mechanical/electronic split matters on mirrorless bodies. 0x00A7 counts every frame, including silent ones. When the camera also writes 0x0037 and the two numbers differ, our tool shows both, because the mechanical number is the one that measures shutter wear.
Sony: tag 0x9050, enciphered
Sony keeps the count in a binary block at maker-note tag 0x9050. The ExifTool Sony table says: “Data for tags 0x9050, 0x94xx and 0x2010 is encrypted by a simple substitution cipher.” The cipher is described in a comment in Sony.pm’s Decipher routine:
The formula is: $c = ($b*$b*$b) % 249, where $c is the enciphered data byte (note that bytes with values 249-255 are not translated…)
Every byte from 0–248 is cubed modulo 249. Because cubing happens to be reversible mod 249, we invert it once into a 256-entry lookup table. Here is a real four-byte field from an ILCE-7M4 ARW:
enciphered: 5E 96 00 00
deciphered: 07 42 00 00 (7³ mod 249 = 343 − 249 = 94 = 0x5E, and so on)
little-endian int32: 0x00004207 = 16,903ExifTool reports 16,903 for that file. Nine byte values (0, 1, 82, 83, 84, 165, 166, 167, 248) cube to themselves, so an enciphered block can have plain-looking bytes scattered through it.
The harder part is that the count sits at a different offset depending on the model. Sony.pm chooses one of four layouts by matching the model name:
| Layout | ShutterCount offset | Models (per ExifTool) | ExifTool note |
|---|---|---|---|
| Tag9050a | 50 (0x32) | SLT, NEX, early ILCE such as the original A7R | ”total number of image exposures made by the camera, modulo 65536 for some models” |
| Tag9050b | 58 (0x3A) | “Valid from July 2015 for ILCE-6100/6300/6400/6500/6600/7C/7M3/7RM2/7RM3/7RM4/7SM2/9/9M2, ILCA-99M2" | "total number of image exposures made by the camera” |
| Tag9050c | 58 (0x3A) | ILCE-1, 7M4, 7RM5, 7SM3, ILME-FX3 | same |
| Tag9050d | 10 (0x0A) | ILCE-6700/7CM2/7CR; ILCE-1M2/7M5/7RM6 “when using mechanical shutter" | "total number of mechanical shutter actuations” |
Two consequences for anyone buying a used Sony:
- Wraparound. On some Tag9050a bodies the counter is modulo 65,536, so a body showing 3,000 may have actually fired 68,536 times. ExifTool doesn’t list which models wrap, so our checker adds that warning to every body in this family.
- Silent shooting. A source comment on the 0x3A field says the count “does not increase during Silent Shooting, at least for ILCE-7RM2.” The Tag9050d field explicitly counts mechanical actuations only. On these bodies an electronic-shutter frame doesn’t add to the number.
If a Sony model isn’t in ExifTool’s list, we return encrypted and don’t read a guessed offset. Cyber-shot (DSC-) models are excluded by ExifTool’s own condition (“not valid for DSC/Stellar models”), so for those we report unsupported-model.
Pentax: tag 0x005D, encrypted with the timestamp
Pentax takes a different approach. From the ExifTool Pentax table:
| Tag | Name | Type | ExifTool note |
|---|---|---|---|
| 0x0006 | Date | undef[4] | “changing either Date or Time will affect ShutterCount decryption” |
| 0x0007 | Time | undef[3] | — |
| 0x005D | ShutterCount | undef[4] | “May be reset by servicing! Also, does not include shutter actuations for live view or video recording” |
The algorithm is CryptShutterCount in Pentax.pm: count = raw XOR date XOR (0xFFFFFFFF − time), with the 3-byte time padded with a zero byte. Using the real K10D vector from our tests (shot 2008-03-02 at 12:01:23):
raw 0x005D F4 26 ED 8D → 0xF426ED8D
Date (2008-03-02) 07 D8 03 02 → 0x07D80302
Time (12:01:23) 0C 01 17 +00 → 0x0C011700 → 0xFFFFFFFF − t = 0xF3FEE8FF
0xF426ED8D ^ 0x07D80302 ^ 0xF3FEE8FF = 0x00000670 = 1,648ExifTool gives 1,648 for the same file. XOR is its own inverse, so the same function also encrypts. This also means that if a tool rewrites the Date or Time tags, the count decodes to nonsense. When those two tags are missing, our tool returns encrypted and shows no number. Pentax.pm notes that the tag is used by every Pentax DSLR except the *istD and *istDS on firmware before 2.0. It also records that a brand-new K10D’s first frame showed counts like 81, 181 or 246, because of factory test shots. A new Pentax that doesn’t start at 1 isn’t necessarily a sign that someone lied.
Why Canon, Fujifilm, Olympus and Panasonic come back empty
This is where many online checkers overpromise. We checked each brand’s ExifTool table:
| Brand | What ExifTool documents | What our tool does |
|---|---|---|
| Canon | ShutterCount only inside model-specific CameraInfo blocks: the EOS-1D Mark III (“may be valid only for some 1DmkIII copies, even running the same firmware”), EOS R5/R6, R6 Mark II and PowerShot G5 X Mark II, plus a FileInfo field on 1D bodies (“reports that the ShutterCount changed when loading a settings file on the 1DSmkII”) | unsupported-maker. CR3 files are identified but not parsed |
| Fujifilm | No ShutterCount. There is an ImageCount (int16u) that “may reset to 0 when new firmware is installed” | unsupported-maker, because a counter that resets isn’t an actuation count |
| Olympus / OM System | No shutter-count tag in any table | unsupported-maker |
| Panasonic | No shutter-count tag in any table | unsupported-maker |
For most Canon EOS bodies, ExifTool finds no count in the file at all. For the few where ExifTool found it, it’s in a per-model offset table that its own author marks as unreliable. We decided an honest “we can’t read this from a file” is better than a number that might be wrong. To get a real Canon count you have to query the camera itself or ask a service center.
When we built the tool, the original plan also included Olympus (a supposed count in the ImageProcessing sub-IFD) and a possible Fujifilm path. Checking against ExifTool 13.59 output on real files didn’t support either, so we cut the supported list down to Nikon, Sony and Pentax before launch.
Why your edited or shared JPEG shows nothing
Maker notes are fragile. Many offsets inside them point back into the EXIF block, so software that rewrites EXIF has to copy the blob across and keep those offsets valid. Anything that re-encodes the image builds a new file and keeps only the metadata it chooses to write. Here is Pillow 12.1.1, a very common image library, resizing a JPEG with its default settings:
>>> a = Image.open('orig.jpg')
>>> a.getexif()
{272: 'NIKON Z 6', 271: 'NIKON CORPORATION'}
>>> a.resize((32, 32)).save('resaved.jpg', quality=85)
>>> Image.open('resaved.jpg').getexif()
{}Not even Make and Model survived. Editors, gallery apps and upload pipelines all make this choice, and removing metadata is often deliberate for privacy reasons, as we covered in does your photo leak your location?. Our EXIF remover does the same thing on purpose: it drops the whole APP1 segment, maker notes included, without re-encoding the pixels.
Our checker tells these cases apart:
| Status | Meaning |
|---|---|
found | Decoded, with the source tag named (e.g. “Nikon maker note tag 0x00A7”) |
stripped | EXIF exists but the maker note, or even Make, is gone. The file was edited or exported |
encrypted | Sony layout not decoded by ExifTool, or Pentax key tags missing |
unsupported-model | Right brand, but this model writes no count (Coolpix, Cyber-shot, *istD) |
unsupported-maker | Canon, Fujifilm, Olympus, Panasonic, or anything else |
no-exif | No EXIF at all, or not a file type we recognize |
The fix is always the same: take one fresh shot and copy the file straight off the card.
Using the checker
The shutter count checker accepts JPEG and TIFF-based RAW (NEF, ARW, PEF, DNG, ORF, CR2, RW2), plus Fujifilm RAF, where it reads the EXIF from the embedded JPEG preview. It runs entirely in your browser, and nothing is uploaded. It reads the first 32 MB of the file and only rereads the whole file (up to 512 MB) when a recognized photo looks cut off. You can check a seller’s 60 MB sample RAW this way without it leaving your machine.
Practical checklist for a used-camera purchase:
- Ask for an unedited file straight from the card, shot today. A RAW is best. An old or edited file tells you nothing about the camera now.
- Compare
Modelagainst the listing. A photo from a different body still gives a valid count, just not for the camera you’re buying. - On a Nikon that writes a mechanical count, judge wear by that number. On an older Sony (SLT, NEX, early ILCE), think about wraparound. On Pentax, remember that a service center can reset the counter.
- If you post your own listing photos, run them through the EXIF remover first. EXIF can include a body serial number (tag 0xA431), and Nikon maker notes carry one too.
A count below the rated life is a good sign, but it isn’t a guarantee. A number from a brand that doesn’t store one is worse than no number, and our tool won’t give you one.