Can Screenshot Metadata Be Forged? What We Measured, and Why It Is a Red Flag

Yes, screenshot metadata can be forged — but only by injecting fake data by hand, because a real screenshot has none to forge in the first place. On this machine (2026-11-12, Python 3.13 + Pillow 12.3.0 + piexif 1.1.3) we confirmed the two facts that make this question strange: a clean screenshot PNG carries zero EXIF fields (piexif could not even read it, reporting “neither JPEG nor TIFF”), and the standard piexif library refuses to insert EXIF into a PNG at all. We then proved forgery is technically possible: by hand-writing a raw eXIf chunk we added 12 fake fields — Make Apple, Model iPhone 14 Pro, a 2024 timestamp, and a GPS fix — and they round-tripped exactly (+317 bytes). The catch: that chunk is fragile, and a single re-save through any normal tool deletes it. So a screenshot that does carry EXIF is, by definition, a file someone deliberately tampered with — the opposite of proof. For the baseline this builds on, see do screenshots have exif data.

The short version

Most “can you forge screenshot metadata” questions are built on a false premise: that a screenshot quietly carries a hidden, authentic record (device, time, location) waiting to be edited. It does not. A screenshot is a pixel capture, saved as a PNG, and a PNG screenshot file normally contains no EXIF at all — so there is no authentic metadata to alter.

What you can do is bolt a fake EXIF block onto the PNG container after the fact. We did exactly that, measured it, and watched it fall apart the moment the file was touched again. The practical conclusion: EXIF on a screenshot is evidence of tampering, not of authenticity. The rest of this page is the test that backs that up.

What we actually tested, on 2026-11-12

We used the same engine as our other metadata tests: Python 3.13 with Pillow 12.3.0 and piexif 1.1.3. The plan was four steps, each producing a real number:

Build a synthetic screenshot PNG (a 1200×800 window-style capture) and try to read its EXIF.
Try to inject EXIF into that PNG with the standard piexif.insert call.
Manually write a raw eXIf chunk into the PNG and read it back.
Re-save the forged PNG through Pillow and check whether the fake block survives.

Every number below came from that run. Nothing is quoted from a blog post.

Finding 1: a clean screenshot PNG carries no EXIF — piexif cannot even read it

The clean capture was 6,529 bytes. When we pointed piexif.load at it, the result was not “0 fields” — it was an outright error:

InvalidImageDataError: Given file is neither JPEG nor TIFF.

That is the honest finding. piexif 1.1.3 does not parse EXIF from PNG at all; it only understands JPEG and TIFF. A genuine OS screenshot is PNG, so the library's own behaviour tells you the format has nothing for it to read. This matches our earlier measured result that a Windows Snip & Sketch capture contains zero EXIF chunks — see do screenshots have exif data for that byte-level read.

Finding 2: the standard library will not inject EXIF into PNG either

We then tried the normal (lazy) forgery path: piexif.insert(exif_bytes, png_path, out_path). Same error class, raised before anything was written:

InvalidImageDataError

piexif only knows how to insert into JPEG and WebP. PNG is simply not a supported target. So the most common EXIF tool in Python will not forge metadata onto a screenshot for you — you have to go lower level than the library.

Finding 3: forging EXIF onto a screenshot IS possible — at the container level

The PNG spec does allow an eXIf chunk, so we wrote one by hand: a correct chunk length, the eXIf type, a CRC, and a standard EXIF payload (the same bytes piexif.dump would produce) carrying a fabricated identity. We injected Make Apple, Model iPhone 14 Pro, Software iOS 17.5, a DateTime of 2024:01:01 08:00:00, a matching DateTimeOriginal, and a GPS fix.

Result: the file grew from 6,529 to 6,846 bytes (+317 bytes), and the extracted payload parsed back to exactly what we wrote — IFD0 6 fields, Exif 2 fields, GPS 4 fields (12 total), with Make=Apple, Model=iPhone 14 Pro, GPSLatRef=N, and the latitude [[31,1],[13,1],[2,1]] all correct. Byte-for-byte, the injected EXIF equals the EXIF we intended to write. The forgery works.

Finding 4: the forgery is fragile — any re-encode wipes it

We reopened the forged PNG with Pillow and saved it again as a PNG — the kind of thing that happens the instant anyone opens, crops, or re-uploads a “screenshot.” The result: the file went straight back to 6,529 bytes, the eXIf chunk was gone, and the field count returned to 0.

Pillow does not preserve the eXIf chunk on a re-save. So any forged screenshot that survives editing, cropping, or platform re-encoding was not just forged once — it was deliberately re-injected after every single edit. That is a lot of effort to fake a field that a real screenshot never had.

What this means: a screenshot with EXIF is a red flag

Put the four findings together:

A real screenshot has no EXIF (Finding 1).
The standard tooling won't add it (Finding 2).
Adding it requires manual chunk surgery, and it round-trips (Finding 3).
It vanishes on the first normal re-save (Finding 4).

Therefore, if you receive a “screenshot” that shows a capture time, a device model, or GPS coordinates in an EXIF viewer, you are not looking at ordinary screenshot output. You are looking at a PNG someone modified on purpose. That makes the EXIF less trustworthy than an ordinary screenshot, not more — it is a signed confession of tampering. This is the same logic we applied in can a screenshot be used as evidence: a PNG carries no self-authenticating metadata, so it cannot prove when or on what device it was made. The full byte-level read behind this is in our guide on whether screenshots carry EXIF data at all.

How to check whether a “screenshot” has been tampered

You do not need special forensics. Three quick checks:

Open it in any EXIF viewer. If it shows Make/Model/DateTime/GPS, that alone is suspicious — a genuine screenshot should show nothing.
Re-save it once and look again. If the EXIF disappears, it was riding in a fragile eXIf chunk and was never part of the original capture. (We measured exactly this: 6,846 → 6,529 bytes, chunk gone.)
Compare the byte signature. A real OS screenshot is plain PNG (IHDR, IDAT, IEND, plus maybe pHYs/sRGB). An injected one carries an eXIf chunk you can spot with a hex/string search for the marker Exif\x00\x00.

If you need to remove metadata rather than hunt forgeries, the same engine we used is what our clear metadata from photo guide is built on.

The honest limits of our test

We state these so you do not over-read the result:

We used a synthetic 1200×800 PNG built to mimic a window capture, not a capture taken through a real OS screenshot tool. The conclusion about PNG behaviour — no EXIF, manual eXIf possible, dropped on re-save — is a property of the file format and the libraries, which is why it holds regardless of which app made the picture.
We tested EXIF forgery only. Visual forgery (editing pixels, faking a UI) and steganography (hiding data in pixels) are different categories and were not part of this run.
We did not test every OS or every screenshot tool. The relevant fact is format-level: PNG screenshots do not carry EXIF, and the standard EXIF libraries will not put it there for you. If you want the field-by-field background, start at what is EXIF data, and for why a screenshot never exposes your location through metadata see do screenshots reveal your location.

FAQ

Can a screenshot's EXIF be trusted as proof of when it was taken? No. A real screenshot has no EXIF at all, so there is no capture time to trust. If a screenshot file shows a DateTime in an EXIF viewer, that field was injected after the fact and is, by definition, unverified.

Does editing a screenshot remove forged metadata? In our test, yes — a single re-save through Pillow dropped the entire eXIf chunk and returned the file to 6,529 bytes with 0 fields. So ordinary editing tends to erase a forgery rather than preserve it.

Will a screenshot tool like Snip & Sketch ever add EXIF on its own? No. We measured that a Windows Snip & Sketch capture produces a plain PNG with no eXIf chunk, and piexif cannot even parse EXIF from PNG, so there is nothing a screenshot tool adds automatically.

Can I add fake GPS to a screenshot to make it look real? Technically yes, by hand-writing an eXIf chunk — we did exactly that and it round-tripped. But the chunk is fragile and disappears on re-save, and its mere presence proves the file was modified, which defeats the goal of making it “look real.”