C2PA Content Credentials Verifier
Check a photo or video for Content Credentials (C2PA): who signed it, whether the signature still validates, and whether AI involvement was declared — verified on your device.
Content Credentials are a tamper-evident label for media, built on the open C2PA standard from the Coalition for Content Provenance and Authenticity (Adobe, Microsoft, Google, the BBC, camera makers and newsrooms). When a camera, editing app or AI generator signs a file, it embeds a signed manifest: who made it, with what, what was changed, and whether AI was involved. This verifier reads that manifest and checks the cryptographic signature — the same check the official Content Credentials tools perform.
The file is verified on your device — it is never uploaded. First check downloads the verification engine once (~6.6 MB, then cached).
How to use
- Choose or drop a photo or video file (JPEG, PNG, WebP, AVIF, MP4 and other C2PA formats work). The verification engine loads once, about 6.6 MB, and is cached by your browser.
- Read the verdict panel: credentials verified, credentials invalid or altered, or no credentials found.
- Open the details: the signer, the tool that created the file, its declared history, and any AI involvement declared in the manifest.
About this tool
Unlike upload-based checkers, everything happens on your device. The verifier is powered by c2pa-js (version 0.30.17), the official open-source JavaScript SDK from the Content Authenticity Initiative, self-hosted on this site. Your photo or video is opened by your browser and never transmitted; remote-manifest lookup and certificate revocation (OCSP) lookups are switched off so the file cannot trigger any network request.
A signed file is still rare in the wild: credentials appear on photos from a few high-end cameras, on images from generators such as DALL·E and Adobe Firefly, and on media from participating newsrooms. Most files you test will have no credentials at all — which tells you nothing about whether they are real, only that nobody signed them. For the other traces a file can carry, try the AI Image Signals Checker; for a full metadata readout, the EXIF Viewer.
How it works
How verification works: the SDK parses the file’s embedded manifest store, recomputes the hashes of the file’s data, and validates the claim signature against the signer’s certificate chain. If a single byte of the signed content changed after signing, validation fails — that is what makes the credential tamper-evident.
What the three results mean. “Credentials verified”: a manifest is present and every check passed. “Signature problem”: a manifest is present but validation failed — the file was altered after signing, the manifest is corrupt, or its hashes do not match. “No credentials”: the file carries no signed manifest, which is the normal state of most photos and videos today and proves nothing either way.
Two honest limits. First, a valid signature vouches for the record, not for reality: a misleading video can be validly signed if nobody altered it after signing. Second, this page disables remote-manifest fetching and live revocation checks to keep your file private, so a credential that lives only in the cloud, or one revoked after signing, will not be caught here — the official online verifier can check those.
Quick reference
| Who signs files today | What gets signed |
|---|---|
| Leica M11-P | Photos at capture — the first camera with built-in Content Credentials |
| Sony Alpha cameras (Authenticity Solution) | Photos at capture on supported Alpha bodies |
| OpenAI (DALL·E, GPT image models, Sora) | Generated images and video carry a manifest declaring AI generation |
| Adobe Firefly & Photoshop | Generated and edited media, with edit history |
| Google (Imagen / Gemini) | AI-generated images carry Content Credentials alongside SynthID |
| Microsoft Designer | AI-generated images signed at creation |
| Newsrooms & agencies (e.g. BBC, CBC) | Published photos and video with verified edit history |
Frequently asked questions
What is a C2PA Content Credential?
It is a signed, tamper-evident record embedded in a media file by the C2PA standard: who created the file, which tools touched it, what edits were made, and whether AI was involved. Because it is cryptographically signed, editing the file afterwards breaks the signature — which is exactly what this verifier checks.
Does “no credentials found” mean the file is fake?
No. It means the file carries no signed manifest. Most cameras and phones do not sign files yet, and screenshots, messaging apps and social platforms strip credentials off files that had them. Absence of credentials is absence of evidence — nothing more.
Can Content Credentials be forged?
A manifest can be copied onto another file, but then its hashes and signature no longer match the content, and validation fails. What a valid credential cannot guarantee is honesty: it proves the signed history is intact, not that a scene was staged truthfully before signing.
Is my file uploaded for verification?
No. Verification runs in your browser using the official c2pa-js library, hosted on this site. This page even disables the library’s remote-manifest and revocation lookups, so checking a file makes no network request about it.
Which files can I check?
Photos and videos in formats that can carry C2PA manifests — JPEG, PNG, WebP, AVIF, TIFF, MP4/MOV and more. Files that cannot carry a manifest simply return “no credentials”.
How is this different from the AI Image Signals Checker?
This verifier does one thing deeply: full cryptographic validation of Content Credentials. The Signals Checker is broader and shallower — it reads every origin record inside a photo (credentials, IPTC source type, generator tags and saved prompts) and lists what it finds, without validating signatures.
More free tools
AI Image Signals Checker
Read every origin record inside a photo — Content Credentials, IPTC source type, generator tags, saved prompts and workflows — and see a plain list of what is actually there. No score, no verdict.
EXIF Viewer & Cleaner
See the hidden data inside your photos — GPS location included — then strip it all before sharing.
Password Strength Checker
How strong is your password — really? Local strength scoring plus a private breach check.
Phone Number Checker
Validate any phone number: country, line type and the correct international format.
IBAN Validator
Check an IBAN for typos before you send money — mod-97 validation and full structure breakdown.
Credit Card Validator
Check a card number’s format: Luhn checksum and card brand, right in your browser.