PNG

PNG is the format you save screenshots into, the format design tools export to, the format your operating system uses for window assets. It’s lossless, smaller than uncompressed, and was designed without EXIF in mind — which didn’t stop image editors from stuffing EXIF into it anyway.

What it carries

PNG’s file structure is a sequence of chunks, each tagged with a 4-letter type code. Chunks split into critical (uppercase first letter — required for decoding) and ancillary (lowercase first letter — optional). Metadata lives in the ancillary chunks:

• eXIf — the EXIF chunk, added to the PNG spec in 2017. Carries the same TIFF-encoded metadata as JPEG: Make, Model, GPS, software, the works. Most modern phones write this when exporting to PNG.
• tEXt — uncompressed key-value pairs in Latin-1. Standard keys: Author, Copyright, Creation Time, Description, Software, Comment. Photoshop, GIMP, and Krita all write these.
• iTXt — UTF-8 textual metadata. Often used for XMP packets (yes, the same XMP that lives in JPEG APP1 segments shows up here under the XML:com.adobe.xmp keyword).
• zTXt — DEFLATE-compressed text. Same data as tEXt with smaller payload.
• pHYs — physical pixel dimensions. Marginal fingerprint but reveals the editor’s DPI default.
• iCCP — embedded ICC colour profile.

What’s unique

PNG was conceived in 1995 as a metadata-light replacement for GIF. The textual chunks were intended for “the photographer’s name and a description” — decorative metadata. Two decades later, every image editor uses them to write the same identifying data as EXIF.

A PNG saved from your iPhone’s screenshot app has no EXIF (Apple strips screenshots). A PNG exported from Photoshop with a phone camera roll original carries everything the JPEG did.

What Tracemute does

The handler runs a chunk allow-list. Only these survive: IHDR (image header), PLTE (palette), IDAT (image data), IEND (footer), gAMA (gamma), cHRM (chromaticities), sRGB (colour space marker), iCCP (ICC profile), tRNS (transparency), pHYs (physical dimensions).

Everything else — eXIf, tEXt, iTXt, zTXt, tIME, vendor-private chunks — is dropped. The CRC32 of each surviving chunk is recomputed, so the output passes every conformance check.

The image data itself (the DEFLATE stream inside IDAT) is byte-identical to the input.

What survives

iCCP, gAMA, cHRM, sRGB — all colour-space metadata kept for rendering fidelity. pHYs (DPI hint) kept because it’s near-useless as a fingerprint and removing it can break print workflows. Everything personally identifying is gone.