Local tool

C2PA checker

Check Content Credentials on a JPEG or PNG. The reader shows the manifest, the claim generator, the signer name, the recorded actions and any trained-algorithmic-media assertion. The file is not uploaded. Signatures are not verified.

17 October 2026 · Check AI Free

What a Content Credentials check can show

C2PA is a way for a file to carry a manifest: a claim about how the asset was made, a list of assertions, and a signature over that claim. Content Credentials is the name people see in products that write those manifests. In a JPEG the manifest store is split across APP11 segments whose payload starts with the two bytes JP. In a PNG it is a caBX chunk. Inside that store, a manifest is a set of boxes. The claim is CBOR and can name a claim generator. The assertion store holds labeled records such as c2pa.actions and c2pa.ingredient. The signature box holds a COSE signature and, often, the signer’s certificate. This page walks that structure and prints the fields a person usually came to see.

The claim generator names the software that produced the claim, with any generator-info name and version stored beside it. The signer line is the common name and organization from the first certificate in the signature’s certificate chain, when that certificate can be parsed. Actions are the history the manifest recorded: created, edited, cropped, filtered, and the other names in the C2PA vocabulary. Each action can name a software agent and a digital source type. Ingredients are other assets the manifest says were used. Assertion labels are listed even when this reader has no special layout for that assertion.

How to read an AI assertion without overreading it

Look for a digital source type, not a product slogan. IPTC’s trainedAlgorithmicMedia value, and the composite types that name it, are what this reader treats as an AI-generated assertion. When that string is in an action, the manifest is asserting that the action used a trained generative model. That is a statement in the file. It is stronger than a visual hunch and weaker than a signature this site has not checked. Some current download paths from major generators document Content Credentials on particular outputs. The file in front of you may be one of those, an edited derivative, or a file that never had a manifest. The reader reports the file it was given.

A manifest on a camera photograph is normal too. The actions will usually say created, and the source type will not be trained algorithmic media. Do not collapse “Content Credentials present” into “AI.” The checker’s AI line stays quiet unless the source type is actually there. A missing manifest is also normal. Many cameras never wrote one. Many generators still do not. Screenshots, messengers and a lot of export dialogs drop the APP11 segments and the caBX chunk. Our edition 1 metadata report did not measure platform uploads; it did show that a local screenshot and a metadata-free JPEG export kept none of the XMP container that had been in the originals. Treat a missing manifest as a property of this copy.

Two neighbouring tools answer neighbouring questions. The EXIF viewer reads camera and caption fields, which a manifest does not replace. The PNG info reader reads parameters and a ComfyUI workflow. Those are unsigned text chunks. A workflow JSON is not a Content Credential, and a Content Credential is not a prompt. If you want a general look at the pixels after the manifest is missing or inconclusive, use the image checker. That path can send a smaller copy to a provider. This checker does not.

Hard limits: 20 MB, a bounded number of boxes, assertions, actions and ingredients, and no attempt to reconstruct a manifest from a thumbnail or a screenshot. If a signature box is present but the certificate name cannot be read, the page says that, and it still does not claim the signature was verified. WebP, HEIC and other containers are out of scope even when a future file might carry a manifest some other way.