Also, when blacking out data from JPEGs, leave generous margins, because there may be compression artifacts in the nearby pixels that also act effectively as a one-way hash. I haven't tested how consistent these artifacts are, but it's better to be safe than sorry.
A few years ago a TV presenter got caught out by this, she posted a cropped photo of herself online, but the original, uncropped version could be recovered from the file which showed her topless.
You can use 'exiftool' on Linux to manipulate the EXIF data, get rid of the thumbnail, or set it to whatever you want. Imagemagick's 'convert' command also has a '-strip' option that will get rid of all EXIF data including any thumbnails.