C2PA Validator
Upload an image or video and inspect the raw structure of its C2PA Content Credentials: whether a manifest exists, whether the signature validates, which tool signed it, which assertions it carries, the ingredient chain and certificate info, and the full raw JSON. All parsing happens locally in your browser.
Upload a file to validate C2PA
How to use
- Click or drag an image/video file onto the upload area.
- The C2PA verification engine runs locally (a ~9MB wasm loads on first use).
- Results are grouped by signature state, validation issues, manifest fields, assertions, ingredient chain, certificate, and raw JSON.
- Search fields, copy, or export the full JSON for your records.
Field meanings
| Manifest | A C2PA provenance claim recording who created or edited a file, with which tool, through which actions. |
|---|---|
| Signature state | trusted = cert in the trust list and valid; valid = cryptographically valid but cert not in this engine’s trust list; invalid = signature or content-hash check failed; unsigned = no C2PA data found. |
| Claim Generator | The software/tool identifier that wrote the manifest. |
| Digital Source Type | IPTC source type, e.g. trainedAlgorithmicMedia for fully AI-generated media. |
| Assertions | Statements inside the manifest, e.g. creation actions, thumbnails, training source. |
| Ingredient chain | Upstream assets this file references, each with its own validation state. |
| Certificate / signature | Issuer, certificate serial number, signing time, and algorithm. |
Scope & limits
- No C2PA data does NOT mean the file is human-made — most platforms never embed it, and export/compression/screenshots strip it.
- "valid" means cryptographically valid with an untrusted cert; it is not proof of forgery.
- This tool only reads and displays C2PA data actually present in the file; it makes no inference or score.
FAQ
- Why does it say valid instead of trusted?
- The signature is cryptographically valid, but the signing certificate is not in this engine’s trust roots. This is common (e.g. a vendor using its own cert) and does not mean the file was tampered with.
- Does "no manifest" mean the photo is real?
- No. Most cameras and AI platforms do not embed C2PA, and any export, compression, transcode, or screenshot removes it. No signal only means "no readable C2PA data in this file."
- Is my file uploaded?
- No. Verification runs entirely in your browser via WebAssembly; the file never leaves your device.