What is actually inside a generated image
More than most people expect, and it is all readable by anyone with the file.
PNG text chunks are the biggest offender. Stable Diffusion, ComfyUI, Automatic1111 write the entire generation configuration into a tEXt chunk with the keyword "parameters": the full prompt, the negative prompt, the seed, the sampler, the model hash, the CFG scale. If you have shared a raw Stable Diffusion PNG, you have shared your prompt.
XMP packets carry the IPTC digitalSourceType field, which is how a file declares itself as trainedAlgorithmicMedia, the standard machine-readable way of saying "an AI made this".
EXIF carries the Software tag naming the tool, plus timestamps. For anything that touched a phone or camera, it also carries GPS coordinates and a device serial number.
C2PA manifests wrap a signed provenance record, usually in a JUMBF container.
The tool lists every block it finds with its location, its size, the specific markers that matched, before removing anything.
Lossless by construction
The removal works on the container, not the image. For a PNG that means walking the chunk list and keeping IHDR, PLTE, IDAT, IEND, the colour chunks, the APNG animation chunks, while dropping tEXt, zTXt, iTXt, eXIf, caBX, anything non-standard. Since whole chunks are removed and none are modified, the surviving CRCs stay valid without recomputation.
For a JPEG it means walking the segment list, dropping APP1 (EXIF and XMP), APP11 (JUMBF), APP13 (IPTC) and COM, keeping APP0 (JFIF), the ICC profile and the Adobe colour transform, and then copying everything from the start-of-scan marker to the end of the file verbatim. The entropy-coded data is never decoded, so there is no generational loss.
For WebP it means keeping VP8/VP8L/VP8X/ALPH/ANIM/ANMF/ICCP, dropping EXIF, XMP, C2PA chunks, clearing the corresponding feature flags in the VP8X header, and rewriting the RIFF size.
Anything appended after the formal end of the image is also dropped. That is a surprisingly common place to hide data.
The limit, stated plainly
Metadata removal is complete and verifiable for the metadata layer. Re-run the check on the cleaned file and it comes back with nothing.
It has no effect whatsoever on watermarks embedded in the pixels. Google SynthID is the prominent example: it is a pattern in the image data, designed to survive compression, cropping, resizing, screenshotting. No metadata operation touches it. Removing it requires regenerating the image through a diffusion model, which changes the image.
When the tool sees signs that a file came from a generator known to use pixel watermarking, it says so on the results page. We would rather tell you the job is half done than let you believe it is finished.