What Metadata Does Stable Diffusion and ComfyUI Embed in Your Images

Stable Diffusion takes the most transparent approach to metadata of any major AI image generator. When you generate an image using AUTOMATIC1111 WebUI, your entire prompt, negative prompt, sampler settings, step count, CFG scale, seed, model hash, and VAE selection are written directly into the file in plain text. ComfyUI goes even further -- it embeds the complete workflow graph as a JSON object, allowing anyone to reconstruct your entire node-based pipeline. InvokeAI has its own metadata format. This radical transparency means that every image you generate carries a complete recipe for reproduction. Anyone with access to the file -- clients, competitors, platforms, or forensic analysts -- can extract your exact creative process from the pixels.

Stable Diffusion WebUI: Your Full Prompt in Plain Text

AUTOMATIC1111's Stable Diffusion WebUI (often simply called "A1111" or "SD WebUI") is the most popular frontend for running Stable Diffusion locally. It is also the most verbose when it comes to metadata embedding.

When you save an image from SD WebUI, the following generation parameters are embedded:

Positive prompt: The complete, untruncated text of your positive prompt. Every word, every comma-separated tag, every weight modifier (e.g., "(masterpiece:1.2)", "best quality, highly detailed") is preserved exactly as you typed it. There is no length limit -- prompts exceeding 500 characters are written in full.

Negative prompt: The full text of your negative prompt, including all exclusion tags and weight modifiers. Negative prompts are often proprietary -- they represent hours of experimentation to find the right combination of exclusion terms that produce clean outputs. This data is fully exposed.

Sampler name: The specific sampling algorithm used (e.g., "DPM++ 2M Karras", "Euler a", "DDIM"). The sampler significantly affects output quality and style.

Steps: The number of denoising steps. This directly indicates how much compute was invested and can hint at the quality tier of the generation.

CFG scale: The Classifier Free Guidance scale value, which controls how closely the generation follows the prompt. This parameter is key to reproducing specific styles.

Seed: The random seed used for generation. Combined with the prompt, sampler, steps, and CFG, the seed allows exact reproduction of the image.

Model hash: A hash of the checkpoint model used for generation (e.g., "7460a6d1" for SDXL 1.0). This identifies which specific model weights were loaded.

VAE hash: The hash of the Variational Autoencoder used, if a custom VAE was specified.

CLIP skip: The number of CLIP text encoder layers to skip, which affects how the model interprets prompts.

Additional parameters: Depending on your configuration, the metadata may also include Hires upscale settings, denoising strength for img2img operations, LoRA hashes, embedding hashes, and extension-specific parameters.

For PNG outputs, all of this data is stored in a PNG tEXt chunk with the key "parameters". The value is a newline-separated text block. For JPEG outputs, the same data is written into the EXIF UserComment field as a JSON-formatted string.

The metadata size depends on prompt length. A typical SD WebUI image contains 2-6 KB of parameter text. Images with extensive prompts and negative prompts can exceed 10 KB.

ComfyUI: Complete Workflow JSON Embedded

ComfyUI takes metadata transparency to a different level. Instead of writing just the generation parameters, ComfyUI embeds the complete workflow graph -- every node, every connection, every parameter -- as a JSON object inside the image file.

When you save an image from ComfyUI, the PNG file contains a tEXt chunk with the key "prompt" (despite the name, it contains the full workflow, not just the text prompt). The JSON object includes:

Node definitions: Every node in the workflow is listed with its type, position, and all parameter values. This includes sampler nodes, checkpoint loader nodes, CLIP text encode nodes, VAE decode nodes, and any custom nodes from extensions.

Connection graph: The links between nodes are explicitly recorded, showing which node outputs feed into which node inputs. This reveals the complete processing pipeline -- whether you used a single-pass generation, a multi-pass refinement, ControlNet conditioning, IP-Adapter injection, or any other multi-step technique.

Model and LoRA references: Checkpoint model names, LoRA model names with weights, and embedding names are all recorded in the node parameters.

Prompt text: The actual text prompts are embedded within the CLIP text encode nodes, appearing as "text" parameter values within the JSON structure.

Resolution and batch settings: Image dimensions, batch size, and seed values are recorded in the appropriate nodes.

The embedded workflow JSON is typically 3-15 KB depending on the complexity of the node graph. Simple single-prompt workflows produce smaller payloads, while complex pipelines with ControlNet, IP-Adapter, multiple LoRAs, and iterative upscaling can produce payloads exceeding 20 KB.

ComfyUI also embeds a second tEXt chunk with the key "workflow" that contains a serialized representation of the workflow's visual layout (node positions, group boxes, etc.). This is primarily for UI reconstruction and adds 1-5 KB of additional metadata.

InvokeAI and Other Frontends

InvokeAI (formerly InvokeAI) uses a different metadata format. It embeds generation parameters in a PNG tEXt chunk with the key "invokeai_metadata" containing a JSON object with the following fields:

• Positive prompt and negative prompt (full text)
• Seed, steps, CFG scale, scheduler, and sampler
• Model name and model hash
• Width and height
• Strength (for img2img operations)
• Any installed LoRA names and weights
• ControlNet settings, if used

The InvokeAI metadata format is more structured and compact than SD WebUI's text format, typically producing 1-4 KB of metadata. It is equally readable by any tool that parses PNG tEXt chunks.

Other frontends have their own conventions:

Fooocus: Embeds a simplified parameter set in PNG tEXt, focusing on the prompt, style selections, and performance settings. Typically 1-3 KB.

Draw Things (iOS/macOS): Writes generation parameters into the EXIF UserComment field in a format similar to SD WebUI. Typically 1-4 KB.

NMKD Stable Diffusion GUI: Embeds parameters in PNG tEXt with a proprietary key. Typically 1-2 KB.

The Privacy and Security Risks of Exposed Prompts

The metadata embedded by Stable Diffusion frontends creates specific risks that differ from those of DALL-E 3 or Midjourney:

Prompt theft: Your carefully crafted prompts -- potentially developed over weeks of experimentation -- are embedded verbatim in every output image. A competitor who downloads your published images can extract your prompts and reproduce your results without any of the development effort.

Negative prompt exposure: Negative prompts are often more valuable than positive prompts. They represent the specific exclusion terms that prevent artifacts, body horror, text corruption, and other common Stable Diffusion failures. Exposing your negative prompt gives away your quality control technique.

Model fingerprinting: The model hash embedded in the metadata identifies exactly which checkpoint, LoRA, and embeddings you used. This can reveal whether you are using commercially licensed models, community models, or fine-tuned proprietary models.

Client confidentiality breach: If you use Stable Diffusion for client work and deliver images with metadata intact, the client can see the exact prompt and parameters used. This can undermine the perceived value of custom work and reveal that the images were AI-generated with specific text inputs rather than manually crafted.

ComfyUI pipeline theft: The complete workflow JSON embedded by ComfyUI is the most significant exposure risk. It does not just reveal your prompt -- it reveals your entire creative process, including multi-pass techniques, custom node configurations, and the specific combination of LoRAs, ControlNets, and IP-Adapters that produce your signature style.

How to Remove Stable Diffusion and ComfyUI Metadata

Stable Diffusion metadata is among the easiest to remove because it consists entirely of plain text in standard PNG tEXt chunks or EXIF fields. There is no cryptographic signing, no certificate chain, and no tamper-evident protection. However, complete removal requires addressing all metadata layers:

PNG tEXt chunks: Both SD WebUI and ComfyUI write metadata primarily into PNG tEXt chunks. Standard EXIF stripping tools often miss these. A complete removal tool must parse the PNG file structure and remove all tEXt, iTXt, and zTXt chunks.

EXIF UserComment: For JPEG outputs, SD WebUI writes parameters into the EXIF UserComment field. This is a standard EXIF field that most metadata stripping tools handle.

Canvas-based redrawing: The most reliable method is to render the image onto an HTML5 Canvas and re-export. This process preserves only the pixel data, discarding all metadata regardless of format or location. It handles PNG tEXt, EXIF, IPTC, XMP, and any other embedded data in a single pass.

After removal, the image file contains no evidence of Stable Diffusion generation. No prompts, no parameters, no model hashes, no workflow graphs. The file is indistinguishable from a clean, metadata-free image produced by any other means.

FAQ

Does saving as JPEG instead of PNG remove Stable Diffusion metadata?

Not reliably. While converting PNG to JPEG changes the file format and may strip PNG tEXt chunks, SD WebUI also writes metadata into the EXIF UserComment field for JPEG outputs. The prompt and parameters are preserved in the JPEG file unless the EXIF data is explicitly stripped. Additionally, many image conversion tools preserve or partially transfer metadata during format conversion.

Can I configure SD WebUI to not embed metadata?

Yes. SD WebUI has a "Save text information about generation parameters as chunks to PNG files" option in the settings that can be disabled. When disabled, the PNG tEXt chunk is omitted from saved images. However, this setting must be explicitly configured, and it only affects new generations -- previously saved images retain their metadata. ComfyUI also has a setting to disable workflow embedding, but it is enabled by default.

If I strip metadata, can the image still be detected as AI-generated?

Yes, possibly. Metadata removal addresses metadata-based identification only. AI detection tools that analyze pixel patterns, noise distributions, or frequency domain characteristics may still classify the image as AI-generated regardless of metadata presence. However, the vast majority of automated platform-level labeling currently relies on metadata scanning, making metadata removal the most impactful first step. Combining metadata removal with other techniques provides the most comprehensive protection.

---

Stable Diffusion and ComfyUI embed your complete creative process -- prompts, parameters, model references, and entire workflow graphs -- in plain text inside every generated image. This data is readable by anyone, transferable to ComfyUI, and represents a significant privacy and competitive risk. RemoveAI Image strips all of it -- prompts, parameters, workflow JSON, model hashes, and more -- through browser-based canvas redrawing, with zero uploads to any server. Protect your creative process.