How to Check Image Metadata (EXIF) to Verify a Photo

EXIF data can reveal whether a photo came from a camera or a generator, but it is trivially stripped. Here's how to read it and where it stops helping.

Metadata is the first thing to check on a suspicious image and the last thing you should trust on its own. Both halves of that sentence matter, and most guides only tell you the first half.

What EXIF actually is

EXIF (Exchangeable Image File Format) is a block of data cameras write into image files. A photo straight off a DSLR or phone typically carries:

• Camera make and model, lens
• Exposure settings, aperture, shutter speed, ISO, focal length
• Original capture timestamp
• GPS coordinates, if location was enabled
• Software field, if the file was edited
• Colour profile and orientation

AI generators write none of this. There is no aperture on a diffusion model. So the absence of camera EXIF is a signal, a weak one, for reasons we will get to.

How to read it

On a Mac: open in Preview Tools Show Inspector the ⓘ tab. Or mdls filename.jpg in Terminal.

On Windows: right-click Properties Details.

Command line, most thorough: ExifTool is the reference implementation and reads far more than the OS viewers.

exiftool photo.jpg
exiftool -Software -Make -Model -DateTimeOriginal -GPSPosition photo.jpg

In a browser: any online EXIF viewer works, but do not upload anything sensitive to one. Use a local tool for private material.

What generators leave behind

Some AI tools do write identifying metadata, and it is worth knowing the fields:

| Field | What you might see |

|---|---|

| Software | Names of generation or editing tools |

| XMP blocks | Generator-specific keys, sometimes prompt text |

| C2PA manifest | Signed provenance, if the tool implements it |

| Comment / Description | Occasionally the full generation prompt |

Stable Diffusion in particular has historically written generation parameters into PNG text chunks, prompt, seed, sampler, model hash. If you find that, you have an answer. Read exiftool -Parameters image.png and see.

C2PA Content Credentials are the deliberate version of this: a cryptographically signed record of how a file was made. When present they are strong evidence, because they are signed rather than merely written. We covered them in what C2PA Content Credentials are and how to verify them.

Why metadata absence proves almost nothing

Here is where most verification advice goes wrong. Every major platform strips EXIF on upload. Not as a security measure against AI, as a privacy measure, because GPS coordinates in a public photo are a genuine hazard.

Which means:

• A real photo posted to Instagram, Facebook, X, WhatsApp, Discord, or Slack arrives with no camera EXIF at all
• A screenshot of a real photo has no camera EXIF
• Any image that passed through a resize, crop, or format conversion may have lost it
• And exiftool -all= removes everything in one command, deliberately

So "no EXIF" is the normal state of nearly every image on the internet. Concluding "no EXIF, therefore AI" would flag most authentic photos you encounter. This is the single most common error in image verification.

The reverse is equally unsafe: EXIF is writable. Camera fields can be forged onto a generated image in seconds. Unsigned metadata is a claim, not proof.

What metadata is genuinely good for

Given all that, it still earns its place as step one, just not as a verdict:

• Positive identification. Full plausible camera EXIF with coherent exposure settings and a matching timestamp is a meaningful point in favour of authenticity, especially for a file received directly rather than downloaded.
• Internal contradictions. These are the gold. A Make of Canon with a Software field naming an image generator. GPS coordinates in the middle of an ocean. A capture timestamp after the modification timestamp. A 12-megapixel phone model reporting a 1024×1024 square image.
• Signed provenance. A valid C2PA manifest is a different class of evidence from ordinary EXIF.
• Editing traces. The Software field often reveals a real photo that was heavily manipulated, a different question from whether it was generated, and frequently the more relevant one.

The verification order that actually works

1. Read the metadata. Cheap, fast, occasionally decisive. Look for contradictions rather than absence.
2. Check for C2PA credentials. Signed provenance beats everything else when it exists.
3. Reverse image search. If the image predates generative tools or appears in an old news archive, you are done.
4. Run pixel-level detection. This is what works when metadata has been stripped, which is most of the time. Generators leave artefacts in the pixels themselves: texture statistics, frequency-domain regularities, and physically inconsistent lighting that survive re-encoding.
5. Look with your eyes. Hands, text in the scene, reflections, jewellery, teeth, and background repetition. Our 12 signs an image is AI-generated covers what to check.

Step 4 is where a detector belongs. GPTOne's AI image detector is our recommendation, and the reason is directly relevant to this article: it analyses pixel content rather than metadata, so it still returns a signal on a file that has been through three platforms and lost every EXIF tag. It also gives a per-region breakdown, which matters for the common real-world case of an authentic photo with a generated element added.

The free tier covers 20,000 credits with no card required, and paid plans start at $7.99/month if you are verifying images regularly.

For journalists, insurers and moderators

If verification is part of your job, two habits pay for themselves:

• Preserve the original file. Ask for the camera original, not a forward of a forward. Every hop degrades metadata and re-compresses pixels, weakening every subsequent test.
• Record what you checked, not just the conclusion. "No EXIF, detector flagged the upper-left region, reverse search found nothing" is a defensible finding. "It's AI" is not.

Domain-specific walkthroughs: verifying a viral news image and spotting faked damage photos in insurance claims.

The bottom line

Read the metadata first, it is free and sometimes hands you the answer outright through a contradiction. Then ignore its absence entirely, because platforms strip EXIF from nearly everything. Real verification happens in the pixels, so run the file through a pixel-level detector rather than concluding anything from an empty metadata panel.