Free tool
C2PA checker: inspect an image’s signed Content Credentials
This free tool inspects the Content Credentials in a file in seconds: the declared signer, the signature-check results, the recording tool and the counts of source files and recorded details. Free, no account needed.
Inspection
Upload a file
Files are uploaded for this check and never stored by this tool.
Controlled examples use the same code-drawn pixels. The test signer is not trusted. See the method and expected results.
Quick answer
How do I read C2PA Content Credentials in an image?
isGenAI (isgenai.com) is a free C2PA checker: upload the original file and it reads the Content Credentials manifest, reporting the declared signer, recorded actions such as c2pa.created, the digital source type, signature validity and signer trust as separate results. A valid signature shows the record is intact; it does not prove the scene is true.
- Accepts JPEG, PNG, WebP, AVIF, TIFF, HEIC/HEIF, PDF and selected audio and video files up to 25 MiB.
- Uploads are processed in memory and not stored by this tool.
- A file without a manifest is reported as having no record, never as proof of a camera or a human author.
- Signed and unsigned CC0 example files are published so the result can be reproduced.
Last updated by isGenAI. Methodology and limits
Try the same image with and without a signed record
Two example files show the difference between a valid signature and a trusted signer. Pick either example above and compare the signature and signer checks side by side. Both files contain identical code-drawn pixels. The signed copy uses a disposable development certificate, so its signer is intentionally untrusted: the perfect demonstration of validity versus trust.
- Test-signed PNG: the signature validates, the signer is not verified, and the recorded action is
c2pa.created (algorithmicMedia). - Unsigned PNG control: no signed record is found. The identical pixels show exactly why missing credentials alone never establish origin.
After each check, use Download inspection JSON to keep the fingerprint, reported claims and validation details. The report leaves out the original upload; file-record text can still be sensitive, so review it before sharing.
Method, observations and reuse
Checked by isGenAI on with Content Authenticity Node SDK 0.8.3. We reused our CC0 code-drawn image, signed a copy with fresh test credentials and verified that its decoded pixels matched the control. A one-byte change in the signed image data failed the asset-hash check. No trust override or production signing credential was used.
Download hashes and recorded results · Download the reproduction script · Read the method and requirements. Rerunning generates fresh keys and signatures, so file hashes change. The signed fixture’s test certificate expires in October 2036; validation results after that date will differ.
These controlled files and script are available under CC0. They demonstrate parsing and validation, not detector accuracy or real-world authenticity. The Content Authenticity documentation explains test signers; IPTC defines algorithmicMedia as media created by an algorithm without sampled training data.
C2PA checker: read the record and the validation result
A Content Credentials inspection answers two questions with precision: is a supported signed record present, and what does its validation report? Upload the original file and review the signature check, the signer check and the record summary separately. The summary shows the recording tool, declared signer, source-file count, recorded action labels and declared source types: the details stored with the asset, read exactly as recorded.
Signature validity and signer trust are different
A signature can validate while its signer stays unverified under the available trust information, and a failed check is a different result from a file with no manifest at all. This page keeps the three apart. Open the technical details for the validation codes before interpreting the headline. Neither a valid signature nor its absence establishes that the visible scene is true or that the image was made without AI, and we report exactly that.
Use an original file and keep the result in context
The inspection accepts files up to 25 MiB and processes uploads in memory without storing them. Supported types include JPEG, PNG, WebP, AVIF, TIFF, HEIC/HEIF, PDF and selected audio/video formats; a readable manifest depends on what the file carries. Screenshots and re-exports drop credentials, so compare the original with the copy you received, and use the image history checker to read supported EXIF, GPS and saved PNG prompts on your device. The Content Credentials guide shows you how to tell a recorded claim from verified source context.
Sources
Questions about C2PA inspection
What does a C2PA checker show?
It shows whether a file carries a supported Content Credentials manifest and what that manifest records: the declared signer, the recording tool, recorded actions, declared digital source types and the results of the signature and signer checks.
Does a valid C2PA signature mean the image is real?
No. A valid signature means the signed record is intact and the file has not changed since signing. It does not prove the depicted scene is true, and a trusted signer is a separate check from a valid signature.
Why does my image have no Content Credentials?
Most social platforms, messaging apps, screenshots and re-exports remove the manifest. Check the original download. A file without a manifest is reported as having no record, which says nothing about whether AI or a camera made it.
Is the C2PA checker free?
Yes. The isGenAI C2PA checker is free, needs no account and processes uploads up to 25 MiB in memory without storing them.