How to Remove AI Metadata from an Image: Prompts & Location

You spent an evening getting a render right. You export it, drop it into a client deck or a portfolio page, and move on. The picture is what people see. But the file carries a second layer that most people never open, and for AI images that layer can be surprisingly talkative.

Below is what we actually find when we scan AI-generated images, grouped by where they came from. None of this is visible when you look at the picture. All of it is readable by anyone who downloads the file and opens it in a free metadata viewer.

Stable Diffusion and ComfyUI: your entire recipe

Local generation tools are the most generous. Automatic1111-style interfaces write a PNG text field called parameters that holds the full prompt, the negative prompt, step count, sampler, CFG scale, seed, image size and model hash. ComfyUI goes further and can embed the whole node graph as JSON, so someone can load your file and reproduce your exact workflow, custom nodes and LoRA names included.

If your prompts are part of how you earn a living, that's your process handed over with every image.

Hosted generators: Content Credentials

Many hosted image services now attach a C2PA manifest, also called Content Credentials. It's a signed block of data that states which service produced the image, which software agent was involved, when it was created, and that the source is 'trained algorithmic media'. When we scanned two logo files exported from ChatGPT while building this site, each carried a manifest of more than 21 KB naming the OpenAI Media Service API, the ChatGPT agent and a creation timestamp to the nanosecond.

Content Credentials exist for good reasons, and we explain the trade-offs in our guide to C2PA. The point here is simply that they're there, and most people don't know it.

Edited in a desktop app: history and identity

Open an AI render in an editor, tweak it and export, and you often add XMP data: the editing application and version, a document ID, an edit history, and sometimes the name attached to your software licence in the creator field.

Composited with a phone photo: location

The riskiest case isn't pure AI output. It's the mixed image: a product shot from your phone with an AI-generated background, or a selfie run through an AI filter. Depending on the app, the phone's original EXIF block can travel with the result, including GPS coordinates precise enough to identify a building, plus the phone model and a serial number.

What to do before you publish

1. Scan the file first. Knowing what's there tells you whether any of it matters for this particular image.
2. Remove what you don't want to share. A good cleaner removes metadata without re-encoding, so your image doesn't lose quality.
3. Keep your original. Store the metadata-rich version in your own archive in case you need to prove authorship or reproduce the render later.
4. Follow disclosure rules. If a platform or client asks you to label AI-generated work, removing metadata doesn't change that obligation.

You can scan and clean images with our free metadata cleaner. It shows every field it finds before removing anything, and the output is pixel-identical to your upload. If you also publish AI video, the same applies there and then some: see what your video file reveals.