We can’t prove a watermark is gone

Where an AI image keeps its origin

There are three places. The file’s metadata records which tool made it. An invisible pattern sits in the pixels. And a platform hosting the picture can label it on its own servers, whatever the file says. Removing one leaves the other two in place. That’s why the wipe tool never treats a clean file as a clean picture.

What we tested

Our first attempt was a spectral attack from published research. It left the picture almost untouched, and it failed Gemini’s provenance check at every resolution we could run it at. Blending the original’s tone and texture back over redrawn versions failed too, because the original pixels bring the watermark back with them.

What passed was a light redraw by an AI image model, the one we offer as Maximum disruption. It passed Gemini’s check on all three kinds of test image we tried: a portrait with a small face, a profile image full of text, and a close-up gym photo with a heavy mark. On our OpenAI test image it passed OpenAI’s verify tool as well. Results vary from image to image.

Where we stand

The people who build Content Credentials (C2PA) treat removing them as an attack: their security considerations list stripping a manifest as a threat. We take the other side. If the person who made an image can never remove its credential, it stops working as a credential. It becomes a record that follows their file from server to server, long after anyone remembers why it was written.

If you made the image, or you’re licensed to change it, you should decide what stays in the file. The line we won’t cross is misrepresentation. Passing an AI image off as made by a person can break a platform’s terms. Under the EU AI Act’s transparency rules, which apply from August 2026, it can also break the law. Cleaning a file you own is a different act, and our acceptable use policy spells out where one ends and the other begins.

Over 80 free tools

The wipe tool gets the attention, but most of the site does smaller jobs in the same spirit. Read what a photo’s file says about where it came from. Strip the GPS location a phone adds without asking. Compress, convert or crop an image to the size a platform wants. Merge a PDF, redact a page, sign it, or pull the text out of a screenshot. Each tool does one job and stops.

None of the free tools asks you to sign up, shows an ad, stamps its own watermark on your file, or limits how many files you can do in a day. Your files never leave your device. We spend all day taking things out of files that shouldn’t be there, and ads, sign-ups and daily limits belong on that list. Putting them in our own tools would undo the point of the site.

The one tool we charge for

Maximum disruption is the only thing on the site with a real cost behind each image, so it’s the only thing we charge for. It comes in one-time packs with no subscription, and a failed job gives its credit back. It needs a Google sign-in because we keep your results for you. Your before and after pairs sit in your History, uploads are deleted after 7 days and results after 30, and you can delete your account and everything in it yourself. Wiping uploads your image to our servers and nowhere else. That one tool pays for everything else here.

What we still can’t prove

The checks we pass are each company’s own answer. Nobody else can run them, so we can show you a pass but can’t prove the mark is gone. Platforms label images on their own servers and may do it whatever the file says. And a redraw strong enough to disrupt the watermark always costs the picture a little detail. Small printed text suffers first. That’s why you see a similarity score and a before and after slider before you download.

Tell us we’re wrong

If you think provenance should stay in a file no matter who owns it, write and tell us why. The same address takes tool requests, bug reports and watermarks we missed: [email protected]. WipeTheAI.com is an independent site, not affiliated with Google or OpenAI.