Supported files
“Clean” means the selected, recognized metadata was removed and the output passed a local rescan. It never means that every unknown byte or every possible clue has disappeared.
| Format | Inspector checks | Cleaner can remove |
|---|---|---|
| JPEG.jpg, .jpeg | EXIF/GPS, XMP, IPTC, comments, and identified C2PA containers | Supported EXIF/GPS, non-appearance XMP, IPTC, and comments; C2PA only when selected |
| PNG.png | eXIf, text and time chunks, plus identified caBX/C2PA containers | Supported eXIf, text, and time data; caBX/C2PA only when selected |
| WebP.webp | EXIF, XMP, and identified C2PA containers | Supported EXIF/GPS and non-appearance XMP; C2PA only when selected |
| GIF.gif | Comments, supported application metadata, and safe plain-text blocks | Comments, supported XMP, and safe plain text; identified C2PA application data only when selected |
Always conservative: the tool preserves encoded pixels or frames, ICC color information, animation controls, required orientation behavior, unfamiliar structures, and appearance-critical data. Malformed or excessively complex files fail closed instead of producing a guessed output.
Requires JavaScript and Web Worker support in a modern desktop or mobile browser.
Four local steps
Select a JPEG, PNG, WebP, or GIF up to 25 MiB and 40 megapixels, or open the built-in demonstration. The file is read on this device.
Read the plain-language privacy summary, provenance clues, technical details, and the exact structures the browser recognized.
Review the supported privacy metadata selected for standard cleanup. Content Credentials and other identified C2PA data are a separate choice because provenance can be valuable.
The cleaner creates a new file without re-encoding image data, rescans it locally, and shows a receipt of what was removed and preserved before download.
AI photo metadata and provenance
Metadata may contain an AI-related label or a C2PA provenance container. Either can be copied, stripped, incomplete, invalid, or absent.
It reports supported metadata and structurally identified C2PA data. It does not validate signatures, certificates, issuers, trust chains, or assertions.
No AI label does not prove human authorship. Pixel-level or invisible watermarks such as SynthID are not detected or removed.
Content Credentials may help a recipient understand a file's history. Remove identified C2PA data only when that privacy tradeoff is intentional.
Browser privacy
This route uses a deliberately smaller network boundary than the rest of the marketing website.
The page reads it through the browser's file API. It does not receive a path it can use to browse other files.
Parsing and cleanup run off the main page thread. Limits of 25 MiB, 40 megapixels, 10,000 container structures, and 1 MiB of decoded metadata text bound the work.
Its Content Security Policy disables analytics, Fetch, XHR, WebSocket, and similar connections. The page itself and its required scripts, styles, icons, and demo image are static assets served from nullkit.app.
The original is not changed. The download becomes an ordinary file under your browser and operating system's storage rules.
Outside this boundary: NullKit cannot control a compromised browser or operating system, installed extensions, screenshots, backups, sync folders, a file you uploaded earlier, or details visible in the image itself.
Clear answers
No. Inspection, cleaning, and verification run in a browser worker on this device. Analytics are disabled on this tool route, and its page-specific security policy blocks Fetch, XHR, WebSocket, and similar connection APIs. The page and its static assets still load from nullkit.app. Your browser, operating system, and installed extensions remain outside NullKit's control.
No. For a supported, valid file, the cleaner removes selected recognized metadata containers without decoding and re-encoding the image or animation frames. The file size can change, and minimal orientation data may be rewritten so the photo keeps its intended display direction.
No. The cleaner is deliberately conservative. Color profiles, orientation, animation controls, secondary-image or HDR data, appearance-critical fields, and unfamiliar structures may be preserved. The result receipt lists what the tool removed and what it intentionally kept.
Yes, when the image is a supported JPEG, PNG, WebP, or GIF. Standard cleanup removes supported EXIF, GPS, comments, and non-appearance metadata. Identified C2PA or Content Credentials data is a separate opt-in choice because removing it also removes useful provenance. Pixel-level and invisible AI watermarks are not detected or removed.
No. It can report supported AI-related labels or provenance containers that are present, but it does not classify pixels. Missing metadata is not proof that a photo was made by a person, and pixel watermarks such as SynthID are not detected or removed.
No. The inspector identifies supported C2PA containers and reports their presence, but it does not validate a signature, certificate, trust chain, issuer, or assertion. Use a dedicated, current verification service when authenticity decisions matter.
JPEG, PNG, WebP, and GIF are supported for inspection and conservative cleaning. HEIC, HEIF, AVIF, RAW camera files, PDFs, videos, and files above 25 MiB or 40 megapixels are not accepted by this version.