C2PA Content Credentials
Reads the JUMBF manifest in APP11 / caBX: who made it, with which tool, what was done, and who signed it.
See where a picture really came from
One line that says whether this picture was shot on a camera, generated by AI, or stripped of its origin and relabelled. Based on every metadata segment in the file, not a guess.
Drop a picture here, or click to choose
Ctrl+V works too. JPEG, PNG and WebP get the full analysis. Up to 50 MB.
AI generation traces
Stable Diffusion parameter blocks, ComfyUI workflows, Midjourney job IDs, IPTC DigitalSourceType, and the signatures of twenty-odd generators.
AIGC implicit label
The implicit metadata label required by the AI-generated content labelling rules, with the provider and content ID.
EXIF vs XMP cross-check
Capture time that does not match, a Photoshop claim with no EXIF, a derived-from with no history: these contradictions are called out.
What metadata can and cannot tell you
EXIF, XMP and PNG text chunks are plain text that any tool can rewrite or delete, so they are self-declarations. A C2PA manifest is signed and is currently the only origin claim that can be verified. AuditImage verifies the signature, the content hash binding and the certificate chain against the C2PA trust list; only the timestamp token is reported without being verified. Invisible watermarks such as SynthID are not metadata and are not detected here.
Frequently asked questions
- What are C2PA Content Credentials?
- C2PA is an open standard from a coalition including Adobe, Google, Microsoft and OpenAI. When a camera or generator exports a picture it writes a digitally signed manifest of who, with what, and what was done into the JPEG APP11 segment or the PNG caBX chunk. Anyone can read the manifest and verify it has not been altered.
- Can metadata prove a picture is AI-generated?
- It can only prove the file says so. EXIF, XMP and PNG text chunks are plain text that any tool can rewrite or delete. Only a signed C2PA manifest can be verified. That is why the verdict distinguishes a signed declaration, a self-declaration in metadata, contradictory metadata, and no metadata, instead of answering yes or no.
- What is the AIGC implicit label?
- The Measures for Labelling AI-Generated Synthetic Content, in force since 1 September 2025, require providers to write an implicit label into file metadata with the content type, provider name or code and a content ID. AuditImage looks for it in PNG text chunks, XMP and JPEG comments.
- Why does my picture show "no usable metadata"?
- Screenshots, re-uploads through social platforms, messaging apps and most online compressors remove all metadata. That does not make the picture fake. It only means its origin cannot be judged from metadata.
- Does AuditImage keep my pictures?
- No. Pictures are parsed in server memory and discarded immediately. Only the resulting report is stored, and report pages are excluded from search engine indexing by default.
Further reading
Guides →Glossary of image provenance terms
Every term and acronym that appears in an AuditImage report or in these guides, from APP1 to XMP, spelled out and explained in a few sentences each.
SynthID and invisible watermarks versus metadata
Watermarks live in the pixels, metadata in the file. What each can and cannot protect against, and why AuditImage only reads metadata.
JPEG segments and PNG chunks: where metadata lives in a file
How to read every row of AuditImage's "File structure" table. What APP1, APP11, COM, tEXt and caBX hold, and what offset and size tell you.
Common metadata forgeries and how to spot them
Strip and relabel, transplant someone else's EXIF, change the dates, fake a Photoshop record. None of it is hard, and all of it leaves contradictions.
Why metadata disappears
Messaging apps, screenshots, social platforms, online compressors, format conversion. A picture almost always loses its metadata in transit, and that does not mean anything is wrong with it.
XMP and edit history
Adobe's XML metadata. It records the creating tool, document IDs and every edit, and is the main clue to which software a picture has been through.
API
The same endpoint returns the same JSON report as the page. Add lang=zh for the zh-CN wording.
curl -F "[email protected]" "https://<host>/api/inspect?lang=en" # → { "id": "…", "url": "…/en/r/…", "report": { "verdict": { … }, "c2pa": { … }, … } } curl "https://<host>/api/inspections/<id>?lang=en"