Some cameras, editors and AI services attach Content Credentials to the files they produce: a signed record of who made the file, with which tool, and what was done to it afterwards. This page reads that record from an image and shows it in plain language, along with whether the signature and the hashes still match the picture.
It answers "what do the credentials say?" It does not answer "is this image real?" or "is this AI?": a file without credentials is not therefore fake, and a file with them is not therefore true. The official open-source C2PA library runs in your browser, and the image is not uploaded.
Loading the tool…
Overview
About C2PA Content Credentials Checker
What C2PA is. The Coalition for Content Provenance and Authenticity publishes the C2PA technical specification (version 2.2, May 2025, is the one this page was written against). A manifest bundles assertions (statements such as "created by this camera", "edited with this software", "AI-generated"), a claim that references them, and a signature on the claim made with the signer\'s certificate. A hard binding (a hash of the image data) ties the manifest to the file. Several manifests can be chained, each describing one step, with earlier files recorded as ingredients.
What this page shows. Whether credentials exist; the active manifest and all earlier ones; claim generator and title; signer name, issuer, algorithm, serial number and signing time where present; assertions in plain language (edit actions, source type such as "captured by a digital camera" or "generated by an AI model", hash bindings, training/mining preferences, selected Exif fields without location values); ingredients and their relationship; and every validation finding with an explanation, grouped into "the data was altered or broken" and "signer trust". The raw JSON is available, with thumbnails left out.
Validity is not trust. C2PA validation tells you whether the signature is mathematically valid and the hashes match. Whether the signer\'s certificate should be trusted is decided by trust lists, which this page does not apply: it shows signers as stated and does not judge them, and files made with test certificates look just like real ones here. The specification itself says validators should not make value judgements about whether provenance data is "good" or "bad", only whether its assertions can be validated.
Privacy and network. The reader and its WebAssembly module are served by this site. Fetching remote manifests, OCSP revocation checks and trust-list downloads are switched off, so nothing is requested from other servers when you inspect a file.
Compatibility
Supported Formats
JPEG, PNG, WebP, AVIF, HEIC/HEIF, TIFF and GIF images up to 80 MB (decided by the content of the file, not its name). Only credentials embedded in the file are read. Credentials that live elsewhere and are only linked from the file are not fetched.
Guide
How to Use C2PA Content Credentials Checker
- Choose an image (JPEG, PNG, WebP, AVIF, HEIC, TIFF or GIF).
- Read the headline: credentials found or not, and the validation state.
- Open the active manifest for the signer, tools and actions, and the list of all manifests for the edit history.
- Read the validation findings; use the raw JSON if you need the detail.
Highlights
Features
- Provenance, not a verdict Shows what the credentials say and whether the signed data still matches; makes no real/fake judgement.
- Full manifest view Claim generator, signer, time, assertions, ingredients and every earlier manifest.
- Plain-language findings Validation codes explained, split into "data altered" and "signer trust".
- No network calls Remote manifest, OCSP and trust-list fetching are switched off; the file is not uploaded.
- Raw JSON available Inspect the exact manifest data, with thumbnails left out.
Applications
Use Cases
- Checking what a news or stock photo says about its origin and edits
- Seeing whether an image carries an AI-generation declaration written by the tool that made it
- Finding out whether credentials survived an upload, export or compression
- Testing whether an edit after signing breaks the hash binding
- Learning what a manifest, claim and assertion look like in a real file
Good to Know
Limitations
This is not an AI detector and not a truth detector. Content Credentials record what a signer chose to declare. Many real photos have none, and screenshots, re-saves, resizing and uploads to many websites remove them. A generated or edited image without credentials looks the same here as a genuine one without credentials. A valid signature does not mean the content is true or that the signer is who they claim to be.
Trust lists are not applied, so a "valid" result says nothing about whether you should trust the signer. A damaged or unusual manifest may only produce an error message. The wording in this page follows the specification and the library's output; for important decisions use the official Content Credentials verification tools and other evidence as well.
This tool runs entirely in your browser — your file is never uploaded to our servers. See our Privacy Policy for full details.
Support
Frequently Asked Questions
Does this tell me whether an image is AI-generated?
No. It shows what the credentials in the file say. If the tool that made the image recorded an AI source type, it is shown. An image with no credentials, or with credentials that say nothing about AI, tells you nothing either way.
The image has no Content Credentials. Is it fake?
No. Most images have none, and many platforms and editors strip them. Absence of credentials is not evidence of anything.
It says the signature is valid. Can I trust the image?
A valid signature means the data matches what was signed. Trust depends on who signed and on trust lists, which this page does not apply. The credentials can also be accurate about a misleading image.
What does "assertion.dataHash.mismatch" mean?
The image data no longer matches the hash that was signed: the picture was changed or re-encoded after signing. The credentials describe an earlier state of the file.
Is my image uploaded?
No. The official C2PA reader runs in your browser as WebAssembly from this site. Remote manifest fetching and online certificate checks are disabled.
Why do test files show an "untrusted" signer?
Sample files from the C2PA project use test certificates that are not on any trust list. They still show how a manifest is structured and validated.
Keep Going
Related Tools
- Image Color Profile Checker Check an image's colorspace and embedded ICC profile — free and instant.
- Image Integrity Checker Check a JPG, PNG, GIF, WebP, or BMP file for truncation or corruption before you rely on it — free and instant.
- Image Metadata Remover Remove EXIF, GPS, XMP, IPTC and embedded comments from a JPG, PNG, WebP or GIF without re-encoding the picture.
- JPEG Quality Estimator Read the quantisation tables of a JPEG and estimate the encoder quality, with chroma subsampling, progressive or baseline, markers and a metadata summary. In your browser.