What does this file’s provenance record actually say?
Content Credentials are a signed record attached to a file: who signed it, what tool made it, what it was made from, and whether the bytes have changed since. This reads that record and puts it in words. It does not tell you whether the content is true — a camera can take a cryptographically perfect photograph of a screen showing a fake — and it cannot detect AI-generated images. Nothing reliably can.
Loading the reader. It runs in this browser, so this page needs JavaScript — there is no server here to fall back to.
Nothing leaves your browser, and here is the whole of what that means
The file you open is read where it sits. It is not uploaded, not copied to this site, not queued, not logged, and not sent to any third party — there is no endpoint here that accepts a file. No account, no email, no cookies.
The page does fetch three things, all of them from this domain and all of them downloads rather than uploads: the reader itself, an 8 MB WebAssembly module, on the first file you check; whichever trust anchors the setting above is using; and the 5 sample files, if you click one. The worker the reader runs in is not a fourth — it is built in memory, which is why the network panel shows a blob: entry with no server behind it. That is the complete list, and the network panel is a better assurance of it than this paragraph.
What a verdict is worth
A valid record does not mean the content is accurate. It means an asset was signed by someone and has not changed since. Those are different claims and only the second one is being made.
No record is the normal state of the internet. Fewer than 1% of published news images carry one. Absence is not a finding about a file, and it is never rendered here as a warning.
An untrusted signer is the common case, not an alarm. C2PA certificates are paid, there is no free issuer equivalent to Let’s Encrypt, and few authorities are on the official trust list. A file whose signature verified perfectly against an issuer you do not happen to list is intact. Telling that apart from a file that was tampered with is the single most useful thing this reader does: why a valid certificate shows as untrusted.
A verdict can change without the file changing. Certificates get revoked in bulk after the fact, so something that read as trusted yesterday can read as revoked today through no fault of its own.
Where the parts came from
The reading and the wording are content-credentials-view, an open-source React library built on c2pa-js, the Content Authenticity Initiative’s own SDK. The sample files are the C2PA project’s public test assets and edits of them — third-party test files, not ours, not examples of our work. Their origin and checksums are recorded in public/content-credentials/README.md.
This site is not affiliated with or endorsed by the C2PA or the Content Authenticity Initiative. For the official viewer, see Content Credentials Verify.