AI Image Metadata Explained: EXIF, XMP, C2PA and the Generator Tags That Expose You

You share a PNG. Someone drags it into a metadata viewer. They read your exact prompt, your negative prompt, your seed, your model checkpoint, the workflow you built over three weeks, the timestamp, and the name of the software you used.

You never agreed to publish any of that. It was inside the file the whole time.

This is the metadata spoke of our AI image detection pillar guide — a full inventory of what image files carry, which blocks get you labelled, and how to remove all of it in one deterministic step.

An image file is a container, not a picture

Think of any JPEG or PNG as a parcel. The compressed pixel data is the contents. Wrapped around it are labelled envelopes of structured information, and software reads those envelopes long before it looks at the picture.

Two of those rows are quietly explosive. The C2PA manifest because it is a signed confession. The PNG text chunks because they are your unedited working notes.

The generator tags that name your model

You do not need a signed manifest to be identified. A single plain string is enough, and generation tools write plenty of them.

• EXIF `Software` — the classic. Frequently contains a product or model name verbatim.
• XMP `xmp:CreatorTool` — same idea, in a different envelope, and often still populated when EXIF has been cleared.
• XMP digital source type — a standardised field whose value can explicitly denote synthetic content.
• IPTC digital source type — the publishing world's equivalent, read by newsroom and platform pipelines.
• Vendor-specific XMP namespaces — model version, generation parameters, safety-check flags.
• PNG parameter chunks — the entire generation recipe as text.

Any one of these is sufficient for an automated pipeline to label your file with total confidence. No classifier, no watermark verification, no ambiguity.

Read next: C2PA Content Credentials explained →

Why selective tag editing keeps failing

The intuitive approach is to open the file and delete the offending tags. In practice it leaves residue, for boringly technical reasons.

• Duplication across blocks. The same fact often appears in EXIF, XMP and IPTC. Clearing one leaves the others.
• Nested and unusual structures. Manifests, maker notes and multi-packet XMP hide fields where naive editors do not look.
• Format-specific containers. JPEG segments, PNG chunks, WebP and AVIF boxes all store metadata differently; a tool built for one misses the others.
• Thumbnails. Embedded preview images can carry their own metadata, and can even show an *earlier* version of the picture.
• Padding and orphaned segments. Deleted regions sometimes remain as readable bytes rather than being truly removed.

The alternative avoids all of it. Decode the image to a raw pixel buffer, discard the original container completely, and encode a brand-new file from those pixels. There is nothing to enumerate, nothing to miss, and no residue — the new file simply has no history to carry.

That is precisely how our Remove AI Metadata tool works.

Removing everything in one pass

1. 1Open the [Remove AI Metadata tool](/remove-ai-metadata). Everything runs locally in your browser — no upload, no server, no queue.
2. 2Add one image or a hundred. Each file gets its own status, so one corrupt file cannot take down the batch.
3. 3Read the detected signals first. Knowing what was there matters — it tells you whether you had a signed manifest or just a stray software string.
4. 4Choose your strength. The default deterministic strip removes the container. Optional resample and dither settings add best-effort pixel-domain disruption, at a cost in fidelity.
5. 5Compare the before/after report. Local heuristics score both versions so you can see what actually changed.
6. 6Download individually or as a batch.

The side benefit: smaller files

Metadata is not free. A manifest with ingredient thumbnails, a full EXIF block with an embedded preview, an ICC profile and a fat text chunk can add tens or even hundreds of kilobytes to a single image — before you have optimised a single pixel.

Re-encoding from raw pixels drops all of that. If page speed is your goal, pair it with our Compress Image tool and Resize Image tool, and see best image compression techniques for the full workflow.

What metadata removal does not do

Be clear-eyed about the boundary, because the layers are independent:

• It does not remove a robust invisible pixel watermark — see what SynthID is and whether it can be removed.
• It does not change the pixel statistics a classifier scores — see how AI image detectors work.
• It does not remove a visible badge burned into the picture — that is the job of the Remove AI Watermark tool.

What it does do, completely and verifiably, is stop your file from announcing its own origin, prompt, device and location to everyone who receives it.