Metadata deep dive

The metadata AI generators accidentally leave behind — and how to read it.

Most people assume AI images are metadata-free. Many aren't. Stable Diffusion tools embed the entire prompt in the file. ComfyUI embeds a full node graph. This page shows exactly where that data lives and how this site's checker reads it.

PNG text chunks

Why Stable Diffusion PNGs often contain the whole prompt.

PNG files are built from a sequence of length-prefixed chunks (IHDR, IDAT, IEND, and others). Among the optional chunk types are tEXt, zTXt and iTXt — free-form keyword/text pairs anyone can write into the file. Automatic1111's Stable Diffusion WebUI and its forks write a tEXt chunk with keyword parameters containing the prompt, negative prompt, sampler, step count, CFG scale, seed and checkpoint hash, by default, on every image it saves — unless a user explicitly strips it.

ToolTypical chunk / fieldWhat's usually inside
Automatic1111 / Forge (Stable Diffusion)tEXt keyword parametersFull prompt, negative prompt, steps, sampler, CFG scale, seed, model hash
ComfyUItEXt/iTXt keywords prompt, workflowEntire node-graph JSON — every model, LoRA and setting used
NovelAItEXt keyword CommentJSON blob with prompt and generation parameters
Midjourney (via Discord export)Usually stripped by Discord's CDNRarely survives — check the original Discord message instead
Adobe Firefly / Photoshop generative fillXMP packet, digitalSourceTypeC2PA-style content credential, not a raw prompt

JPEG EXIF

Camera metadata is a real photo's strongest signal — when it survives.

JPEG files carry metadata in an APP1 segment holding a TIFF-structured EXIF block: a table of numbered tags (Make = tag 0x010F, Model = 0x0110, Software = 0x0131, DateTimeOriginal = 0x9003 in a linked sub-IFD) each pointing to a value elsewhere in the same block. A populated Make/Model pointing to an actual camera brand is meaningful evidence of a real photograph. Its absence is not — Instagram, WhatsApp, Twitter/X and most messaging apps strip EXIF entirely on upload, for privacy reasons that have nothing to do with AI.

Strong signal

Make/Model present

A tag like "Canon EOS R5" or "iPhone 15 Pro" is hard to fake convincingly and rarely appears on generator output unless deliberately forged.

Weak signal

Software tag naming a generator

Some tools write their own name into the Software or UserComment field. Useful when present, but easy to omit or edit — treat as corroborating, not conclusive.

No signal either way

Missing EXIF entirely

The single most common case for any image that has passed through a social platform. Says nothing about origin — plan your workflow assuming it will usually be empty.

Try it

Run this against your own file.

The local checker on this site's homepage implements exactly the parsing described above — PNG chunk reader, JPEG TIFF/IFD walker, and a raw-byte fallback scan for generator name strings — entirely client-side. If your file has this metadata, it will show you the actual text, not a score.

Worked walkthrough

Reading a real tEXt chunk, byte by byte.

A PNG's tEXt chunk is stored as: a 4-byte big-endian length, the 4 ASCII bytes tEXt, then the data itself (a null-terminated keyword followed by the text, both Latin-1), then a 4-byte CRC-32 checksum of the type+data. So a chunk holding keyword parameters and text a photo, Steps: 20, Sampler: Euler a looks like: length = 46, type = tEXt, data = parameters\0a photo, Steps: 20, Sampler: Euler a, then a checksum. This site's checker walks every chunk in the file exactly this way — reading the 4-byte length, checking the 4-byte type against tEXt/zTXt/iTXt, and either reading the text directly or, for the compressed variants, inflating it with the browser's native DecompressionStream('deflate') before reading it.

The honest limit

Metadata can be forged — treat it as evidence, not a seal.

Nothing stops someone from hand-editing a PNG's tEXt chunk to add a fake "parameters" string, or stripping a real one out with any metadata-scrubbing tool. Reading embedded metadata is strictly better than guessing from file size, but it is not cryptographically verified the way a C2PA-signed manifest is. Treat a found generator signature as strong, specific evidence worth taking seriously — and treat its absence as uninformative, since it's stripped constantly by ordinary re-saving, screenshotting and social uploads, with no forgery required at all.

FAQ

Metadata questions.

Will resizing or editing a PNG remove the embedded prompt?

Often yes — most image editors and resizing tools rewrite the PNG from scratch and don't carry over ancillary chunks like tEXt unless the tool specifically preserves them.

Do all Stable Diffusion tools embed metadata by default?

The most common ones (Automatic1111, Forge, ComfyUI) do, by default, unless a user disables it or explicitly strips it before sharing. Hosted or mobile-app generators vary — many strip it automatically.

Can I check this manually without a tool?

Yes — a hex editor or a command like strings yourfile.png | grep -i parameters will often surface uncompressed tEXt chunks directly, since the keyword and text are stored as plain readable bytes.