Supported files
“Clean” means the selected, recognized metadata was removed and the output passed a local rescan. It never means that every unknown byte or every possible clue has disappeared.
| Format | Inspector checks | Cleaner can remove |
|---|---|---|
| JPEG.jpg, .jpeg | EXIF/GPS, XMP, IPTC, comments, and identified C2PA containers | Supported EXIF/GPS, non-appearance XMP, IPTC, and comments; C2PA only when selected |
| PNG.png | eXIf, text and time chunks, plus identified caBX/C2PA containers | Supported eXIf, text, and time data; caBX/C2PA only when selected |
| WebP.webp | EXIF, XMP, and identified C2PA containers | Supported EXIF/GPS and non-appearance XMP; C2PA only when selected |
| GIF.gif | Comments, supported application metadata, and safe plain-text blocks | Comments, supported XMP, and safe plain text; identified C2PA application data only when selected |
| HEIC / HEIF.heic, .heif | Referenced EXIF and XMP items, plus identified C2PA UUID boxes | Supported EXIF/GPS and non-appearance XMP; identified C2PA only when selected |
| AVIF.avif | Referenced EXIF and XMP items, plus identified C2PA UUID boxes | Supported EXIF/GPS and non-appearance XMP; identified C2PA only when selected |
Always conservative: the tool preserves encoded pixels or frames, ICC color information, animation controls, required orientation behavior, unfamiliar structures, and appearance-critical data. Malformed or excessively complex files fail closed instead of producing a guessed output.
Requires JavaScript and Web Worker support in a modern desktop or mobile browser.
Four local steps
Select one supported photo, choose a folder for batch cleanup, or open the built-in demonstration. Every selected file is read on this device.
For one photo, review the detailed privacy and provenance findings. For a folder, review aggregate counts, skipped files, and inspection failures before cleaning.
Review the supported privacy metadata selected for standard cleanup. Content Credentials and other identified C2PA data are a separate choice because provenance can be valuable.
The cleaner rescans every output without re-encoding image data. Save one result, write batch copies under NullKit Output, or use individual download links when direct folder writing is unavailable.
AI photo metadata and provenance
Metadata may contain an AI-related label or a C2PA provenance container. Either can be copied, stripped, incomplete, invalid, or absent.
It reports supported metadata and structurally identified C2PA data. It does not validate signatures, certificates, issuers, trust chains, or assertions.
No AI label does not prove human authorship. Pixel-level or invisible watermarks such as SynthID are not detected or removed.
Content Credentials may help a recipient understand a file's history. Remove identified C2PA data only when that privacy tradeoff is intentional.
Browser privacy
This route uses a deliberately smaller network boundary than the rest of the marketing website.
The page reads them through the browser's file API only after you make an explicit file or folder choice.
Parsing and cleanup run off the main page thread. Limits of 25 MiB, 40 megapixels, 10,000 container structures, and 1 MiB of decoded metadata text bound the work.
Its Content Security Policy blocks third-party analytics and connections. The page may send only its tool identifier, a completed-file count, or a normalized error category to NullKit's same-origin aggregate counter.
Originals are not changed. Verified outputs follow your browser and operating system's storage rules.
Outside this boundary: NullKit cannot control a compromised browser or operating system, installed extensions, screenshots, backups, sync folders, a file you uploaded earlier, or details visible in the image itself.
Clear answers
No. Inspection, cleaning, and verification run in a browser worker on this device. Analytics are disabled on this tool route, and its page-specific security policy blocks Fetch, XHR, WebSocket, and similar connection APIs. The page and its static assets still load from nullkit.app. Your browser, operating system, and installed extensions remain outside NullKit's control.
No. For a supported, valid file, the cleaner removes selected recognized metadata containers without decoding and re-encoding the image or animation frames. The file size can change, and minimal orientation data may be rewritten so the photo keeps its intended display direction.
No. The cleaner is deliberately conservative. Color profiles, orientation, animation controls, secondary-image or HDR data, appearance-critical fields, and unfamiliar structures may be preserved. The result receipt lists what the tool removed and what it intentionally kept.
Yes, when the image is a supported JPEG, PNG, WebP, GIF, HEIC, HEIF, or AVIF. Standard cleanup removes supported EXIF, GPS, comments, and non-appearance metadata. Identified C2PA or Content Credentials data is a separate opt-in choice because removing it also removes useful provenance. Pixel-level and invisible AI watermarks are not detected or removed.
No. It can report supported AI-related labels or provenance containers that are present, but it does not classify pixels. Missing metadata is not proof that a photo was made by a person, and pixel watermarks such as SynthID are not detected or removed.
No. The inspector identifies supported C2PA containers and reports their presence, but it does not validate a signature, certificate, trust chain, issuer, or assertion. Use a dedicated, current verification service when authenticity decisions matter.
JPEG, PNG, WebP, GIF, HEIC, HEIF, and still-image AVIF files are supported for inspection and conservative cleaning. Animated HEIF or AVIF sequences, RAW camera files, PDFs, videos, and files above 25 MiB or 40 megapixels are not accepted by this version. A browser may not be able to preview every HEIC or HEIF file, but NullKit can still inspect and clean its supported metadata structures.
Yes. Folder mode inspects up to 100 supported photos and 250 MiB total, then applies one conservative cleanup policy. Compatible browsers write verified copies into a separate NullKit Output folder while preserving subfolders. Other browsers provide one download link per cleaned photo.