C2PA checker
Drop an image in and see the provenance manifest it is carrying, if it has one, along with what that manifest says about where the image came from.
Drag images in, paste, or click to choose
A whole folder works too · Ctrl/Cmd+V pastes · on phone this opens your photo library · up to 40 MB per file
Read only. This page never changes a file and never uploads one.
What a result here does and does not prove
A manifest is a claim the file makes about itself, and this page reads that claim without checking who signed it. Verifying the signature needs a trusted certificate list fetched over the network, and nothing here touches the network, so treat a named tool as “the file says so” rather than as proof. Adobe’s official Verify site does the signature check.
The reverse matters more: finding nothing is not evidence that an image is real. Metadata comes off with any stripping tool, survives no screenshot, and is dropped by most social platforms on upload. There is also a second kind of mark that lives in the pixels rather than the metadata, and no metadata reader reaches it.
How this C2PA checker reads a file
The file is scanned for the three places a manifest can live: a caBX chunk in PNG, an APP11 segment in JPEG, and a C2PA chunk in WebP. Alongside that, any XMP packet is parsed as the XML it is, which is where the IPTC digital source type sits, and a minimal walk of the EXIF IFD0 picks up the camera and software fields. Everything happens on bytes already in your tab, and the file is opened read-only, so what you drop in is what you still have afterwards.
Where this C2PA checker falls short
- Signatures are not verified. Checking who signed a manifest needs a trusted certificate list fetched over the network, and this page makes no network requests, so a named tool means the file says so rather than that it has been proven.
- Finding nothing does not mean an image is not AI-generated. Metadata comes off with any stripping tool, a screenshot has none to start with, and most social platforms drop it on upload.
- A watermark encoded into the pixels themselves, such as SynthID, is not metadata and no metadata reader reaches it.
Questions about the C2PA checker
- Is the C2PA checker free to use?
- Yes. Reading a manifest costs nothing here and there is no limit on how many images you inspect, because the parsing happens in your own tab rather than on a server someone has to pay for.
- What is C2PA, in one sentence?
- It is a standard for attaching a signed record to a file describing what made it and what has been done to it since, published by the Coalition for Content Provenance and Authenticity and marketed to the public as Content Credentials. Adobe, OpenAI, Google and several camera makers write it into what they produce.
- Why does this checker not say whether the credentials are genuine?
- Because proving that means validating a certificate chain against a trust list, which is a network operation, and nothing on this site talks to the network. Forging a manifest that claims to come from a well-known tool is not hard, and we cannot tell the difference. Adobe's Verify site performs the real check.
