Software (EXIF Software and ProcessingSoftware)

The EXIF Software tag (0x0131) is a free-text string in IFD0 naming the program or firmware that wrote the file. Straight out of a device, it usually holds a firmware version: Nikon bodies write strings like Ver.1.10, and iPhones write the iOS version, such as 17.5.1. After an edit it normally names the editor instead, because most editors overwrite it on save. Lightroom Classic writes Adobe Photoshop Lightroom Classic 13.2 (Windows), operating system included.

So the tag answers two questions people don't always want answered: was this photo edited, and with what? On a phone picture, it also dates the OS build.

One edit, several fingerprints

Clearing EXIF Software is rarely enough, because XMP repeats the information. This Canon EOS RP JPEG went through darktable and then GIMP:

$ exiftool -a -G1 -s -Software -ProcessingSoftware -CreatorTool -HistorySoftwareAgent -XMPToolkit photo.jpg
[IFD0]          Software                        : GIMP 2.10.34
[XMP-xmp]       CreatorTool                     : GIMP 2.10
[XMP-xmpMM]     HistorySoftwareAgent            : Gimp 2.10 (Linux)
[XMP-x]         XMPToolkit                      : XMP Core 4.4.0-Exiv2

GIMP wrote three of those and told us the OS. The toolkit string names Exiv2, the library both programs use for metadata, and the file also carries a whole XMP-darktable namespace with the edit history. Delete the first three tags with ExifTool and look again:

$ exiftool -overwrite_original -m -Software= -CreatorTool= -HistorySoftwareAgent= photo.jpg
    1 image files updated
$ exiftool -a -G1 -s -Software -CreatorTool -HistorySoftwareAgent -XMPToolkit photo.jpg
[XMP-x]         XMPToolkit                      : Image::ExifTool 12.76

ExifTool replaced the toolkit string with its own name. If hiding the editor is the goal, delete the XMP block entirely with -XMP:all= and accept that any rights or caption fields stored there go with it. The XMP toolkit entry has more on that string.

ProcessingSoftware and the PNG Software keyword

ProcessingSoftware (0x000B) is a separate IFD0 string for the program that post-processed the image. ExifTool documents it as used by ACD Systems Digital Imaging, and you will rarely see it anywhere else. A PNG doesn't need EXIF for this at all: Software is one of the predefined tEXt keywords, and ExifTool reports it as PNG:Software.

Where our tools fit

The EXIF editor shows and rewrites Software and ProcessingSoftware in JPEG and TIFF files. The reader asks for EXIF:Software specifically, so a PNG text chunk won't appear there; run exiftool -G1 -s -Software file.png for that.