If you have generated images locally and shared them, you have probably also shared your exact prompt, your negative prompt, the seed, the model you used, the sampler, the step count and — with some tools — your entire node workflow. It is stored inside the file, in plain text, and almost nobody knows it is there.
Where it lives
In a PNG text chunk — the same metadata mechanism used for copyright notices. It is not hidden or encoded; it is a key-value string sitting next to the image data. exiftool image.png reveals it in one command.
What is actually written
Stable Diffusion web interfaces store generation parameters in a single tEXt chunk keyed parameters:
That is enough for anyone to reproduce the image exactly — same seed, same model, same settings. Which is precisely why it is written: reproducibility is genuinely useful when you are iterating.
ComfyUI embeds the whole workflow
Drag a ComfyUI-generated PNG into ComfyUI and the entire workflow loads. That is a genuinely excellent feature for sharing techniques, and it means a casually posted image can disclose a pipeline someone spent months building — or a filesystem path containing their real name.
| Tool | Stores | Where |
|---|---|---|
| Automatic1111, Forge | Full parameter string | PNG tEXt: parameters |
| ComfyUI | Entire workflow JSON | PNG tEXt: workflow, prompt |
| InvokeAI | Metadata JSON | PNG tEXt: invokeai_metadata |
| Fooocus | Parameters JSON | PNG text chunk |
| Midjourney | Prompt text | EXIF description fields |
| DALL·E, Firefly | Provenance, not prompt | C2PA manifest |
Reading it
That last command is the one that makes the point. The prompt is frequently readable in the first few hundred bytes of the file, because tEXt chunks store their content as plain uncompressed text and are written before the image data.
⚠️ Why people assume PNGs are clean
Metadata privacy advice is almost entirely about EXIF and JPEG photos — GPS coordinates, camera serial numbers, timestamps. PNG has no EXIF, so it acquired a reputation for being metadata-free.
It is not. PNG's tEXt, zTXt and iTXt chunks carry arbitrary key-value data, and AI generators use them heavily. The reputation is thirty years old and the usage is three years old.
What it can disclose
| Exposed | Consequence |
|---|---|
| The prompt itself | Can be personal, commercially sensitive, or embarrassing out of context |
| Negative prompt | Often reveals what you were trying to avoid |
| Model and LoRA names | Identifies specific checkpoints, including private ones |
| Seed and settings | Full reproducibility by anyone |
| Workflow graph | Discloses a technique built over months |
| File paths | Frequently contain a username or client name |
| Denoising strength | A non-zero value reveals the image was img2img — it started from something |
The last row is subtle and matters. A denoising strength below 1.0 means the generation started from an existing image. That alone tells a viewer the output was derived from a source, which may be exactly what someone presenting work as fully generated did not intend to disclose.
For commercial work the practical risk is simpler: a client-facing deliverable whose metadata names the LoRA, the base model and the local path /Users/jsmith/clients/acme/ discloses more about your process and your other clients than any contract intended.
Removing it
✅ Stripping PNG metadata is safe
With JPEG photographs, stripping metadata removes the EXIF Orientation tag and can leave the image permanently sideways. PNG has no orientation concept — pixels are always stored as displayed — so there is no equivalent risk.
You can strip PNG metadata unconditionally without needing to bake in a rotation first.
Keeping a copy for yourself
The parameters are useful. The sensible workflow keeps them privately and strips them from anything published:
Does converting formats clean it?
| Conversion | Removes the prompt? |
|---|---|
| PNG → JPEG | Usually — but some tools copy it to EXIF |
| PNG → WebP | Depends entirely on the encoder |
| PNG → PNG (re-encode) | Often not — many tools preserve chunks |
| Screenshot of the image | Yes — new pixels, no history |
Explicit -strip | Yes |
Do not rely on conversion. Strip explicitly and then verify — one exiftool command confirms it rather than assuming a converter behaved as expected.
Platform behaviour
Most social platforms re-encode uploads and lose the metadata as a side effect. That is a side effect, not a guarantee, and it varies:
- Behaviour changes without notice. A platform that strips today may add an "original quality" option tomorrow.
- Displayed and downloadable versions differ. Some services show a stripped derivative and serve the original through a download link.
- Direct file sharing preserves everything. Chat attachments, cloud storage links, email and Discord "send as file" all keep the original bytes intact.
- Image hosts vary widely. Several art and AI-focused hosts deliberately preserve generation parameters as a feature.
🚨 The one that catches people
You post a stripped image publicly, then send the full-resolution original directly to a client or a collaborator. The public copy is clean; the file that went to a third party carries your entire workflow and your local paths.
Strip at the point of export, not at the point of posting. Then every copy that leaves your machine is already clean.
The opposite case: provenance
Commercial generators increasingly embed C2PA content credentials instead — a cryptographically signed manifest recording that the image was AI-generated, by which tool, and what edits followed.
That is deliberately the reverse of the problem above. Generation parameters are metadata you may want gone; provenance credentials are metadata intended to survive, so that an image can be verified as AI-generated downstream.
The tension is real: the same -all= command removes both. If you are stripping prompts from an image that carries content credentials, you are also removing its provenance record — which may be exactly what you want, or may be stripping a disclosure you are expected to preserve.
Strip metadata before you share
Remove embedded prompts, workflows and EXIF data in your browser — the image is never uploaded anywhere, which matters when the metadata is the sensitive part.
Open the EXIF Remover →Summary
- Local generators write the full prompt into PNG text chunks in plain text.
- ComfyUI embeds the entire workflow, including file paths that may name you.
- PNG is not metadata-free. That reputation predates AI tooling by decades.
strings image.pngoften reveals the prompt with no tools at all.- Denoising strength below 1.0 discloses that the image started from a source.
- Stripping PNG metadata is safe — no orientation tag to lose.
- Format conversion is not reliable. Strip explicitly and verify.
- Strip at export, so every copy leaving your machine is clean.
Frequently Asked Questions
Do AI-generated images contain the prompt?
Most local generators do. Stable Diffusion interfaces write the full prompt, negative prompt, seed, sampler, step count, CFG scale and model hash into a PNG text chunk. ComfyUI goes further and embeds the entire node workflow as JSON, which anyone can load and reproduce.
Where is the prompt stored in a PNG?
In a tEXt or iTXt metadata chunk — the same mechanism PNG uses for copyright notices and comments. It sits alongside the image data rather than inside it, so it is trivially readable with any metadata tool and equally trivially removable.
How do I see the prompt in an AI image?
Run exiftool against the file, or open it in a text editor and look near the start — PNG text chunks are stored uncompressed by default, so the prompt is often readable as plain text among the binary data.
Does converting to JPEG remove the prompt?
It removes PNG text chunks, because JPEG has no equivalent. But some converters copy metadata into EXIF fields instead, and some generators write to EXIF directly. Verify with a metadata tool rather than assuming the conversion cleaned it.
Do social platforms strip this metadata?
Most re-encode uploads and strip it as a side effect, but behaviour varies by platform and changes without notice. Some preserve full-resolution originals in a download path even when the displayed version is stripped. Strip it yourself before uploading rather than relying on the platform.