Find PNG metadata stored after IDAT image data

Use a controlled placement change

Download original.png and comment-before-idat.png. Both are 748-byte variants of the same project-authored 1 × 1 PNG. The only ordering change moves the identical compressed Comment chunk from after IDAT to immediately before it. The IDAT bytes and the other original chunks stay unchanged; this is not a social-platform export experiment.

Text chunks can occur on either side of IDAT under the PNG ordering rules. The distinction to check is before IEND versus outside the PNG datastream: the Comment in this exercise is a normal chunk before IEND, not unexplained trailing bytes appended after the end marker.

• Download the original four-text PNG — Project-authored 1 × 1 PNG, 748 bytes, nine chunks and four stored text occurrences. Includes a private ancillary chunk and an explicitly unsigned synthetic credential store. PNG structure fixture v1.
• Download the same Comment placed before IDAT — The zTXt bytes and IDAT bytes are unchanged; their positions and chunk IDs differ.
• W3C PNG Third Edition, 24 June 2025 — Fixed Recommendation: chunk layout, text encodings, ordering, CRC and animation structures. Our bounded tools implement the operations described here, not every conformance requirement.

Record the actual ranges in both inputs

1. Step 1

   Inspect the original after-IDAT version

   Choose original.png in the PNG chunk inspector. Locate chunk-7 IDAT at byte 659, with 11 data bytes and 23 total bytes. Its range ends at byte 682. The next row, chunk-8 zTXt, begins at byte 682 and has 42 data bytes, 54 total bytes and position after idat.

   Open the PNG chunk inspector

2. Step 2

   Inspect the before-IDAT version

   Choose comment-before-idat.png in the same inspector. Its Comment zTXt is now chunk-7 at byte 659, ending at byte 713. IDAT becomes chunk-8 at byte 713 and ends at byte 736. Both versions end with IEND at byte 736. All chunk CRCs match in both files.

3. Step 3

   Save each positional inventory

   Click Download structure JSON after each read and keep the input role clear when naming your local report. The default download name is png-structure-report.json for both. Compare type, offset, length and position rather than assuming chunk-7 has the same role in every file.

Check the decoded field, not just its outer type

1. Step 1

   Read all text in each input

   Choose each PNG in the PNG metadata reader. Both contain four text occurrences and the exact Comment value Synthetic compressed comment. The after-image-data label changes with the field's placement; the value does not.

   Read both files' full text sequence

2. Step 2

   Explain the first-IDAT scan limitation

   A reader that stops when it encounters the first IDAT can reach the before-IDAT Comment but cannot reach the after-IDAT Comment in original.png. This follows from the recorded ranges. It is not evidence that a particular website or detector used such a scan, and it does not imply that every PNG stores a hidden prompt.

Try absent and damaged controls

Choose empty.png. It has only IHDR, IDAT and IEND, so there is no text chunk before or after IDAT. An absence should stay an absence; the reader does not guess the content of a missing prompt or Comment.

Try bad-CRC PNG sample in the structure inspector. The known corrupted copy keeps all nine safely bounded rows and reports one tEXt CRC mismatch. The text reader and writer reject a failed integrity check rather than treating that field as absent. A length extending beyond the file instead stops the bounded walk, preserving a partial diagnosis instead of reading past the buffer.

The inventory reports APNG control/data chunks without playing or flattening animation. An unknown ancillary chunk is displayed with its observed name and range. Neither a clean structure report nor an after-IDAT field establishes authenticity, file safety or valid credentials.

• Download the PNG without metadata chunks — A defined copy containing IHDR, the same IDAT and IEND. It is a missing-text control, not another independent photograph.
• Download the single-CRC diagnostic control — Only the first Author chunk's stored CRC is corrupted; lengths and later chunk ranges stay intact.

Sources and reproducible inputs

• Download the original four-text PNG — Project-authored 1 × 1 PNG, 748 bytes, nine chunks and four stored text occurrences. Includes a private ancillary chunk and an explicitly unsigned synthetic credential store. PNG structure fixture v1.
• Reproducible before-IDAT placement variant — A source-defined reordering, not another independent image or a claim about platform stripping.
• W3C PNG Third Edition, 24 June 2025 — Fixed Recommendation: chunk layout, text encodings, ordering, CRC and animation structures. Our bounded tools implement the operations described here, not every conformance requirement.