New Watermark
Menu

How to verify a photo someone sent you: a checklist

Treat a photo someone sent you as a claim to test, not a fact. Ask for the original file, ask how it was taken, read the signals inside it, search for earlier copies and weigh the source. Our checker covers one step, the file's own signals, and finding none never shows a photo is real.

What should I ask the sender for first?

Ask for the original file, not a screenshot and not a copy pasted into a chat. Our checker reads signals that live inside the file, and those can be lost when a file is re-saved or captured. OpenAI's help article on provenance signals says Content Credentials can be lost through everyday actions such as taking a screenshot or converting a file. For the most reliable result from its own verification tool, it advises using the original exported file and not cropping or converting an image first. The C2PA explainer asks whether provenance data can be removed and answers (section 7.2.3): "Yes it can."

We measured the effect on October 30, 2026. We redrew each of the 9 real files in our test set that carry a Content Credentials record through a browser canvas, which re-encodes the pixels as a screenshot or a browser export does, and saved each as a PNG and as a JPEG. All 18 outputs read "No supported provenance signals found". No record survived either way. This was one browser and one JPEG quality, not a platform. Our guide on screenshots and metadata gives the details.

What should I ask the sender about the photo?

The chapter on verifying images in the Verification Handbook starts with the person. It calls contacting the uploader to ask whether they took the picture the usually most effective way to find the author, because people often repost images they have seen elsewhere. It suggests five plain questions: who they are, where they are, when they got there, what they can see and why they are there. It also suggests asking for other photos taken at the same time.

What can the file itself tell me?

Our checker reads three things inside one file: a signed Content Credentials record, labels in the metadata, and the invisible watermark that Stable Diffusion's reference software adds. It runs in your browser, and your image is not uploaded. It does not check Google's SynthID, Meta's watermark, Adobe's TrustMark or visible marks.

The three signals differ in strength. A signed record shows who signed and that the image matches it, if the signer is on a trust list we load. An unsigned label is a claim anyone can add or remove. Even a trusted record has a limit: the C2PA explainer says provenance information alone cannot tell you whether content is true, accurate or factual (section 7.2.2).

Google says, in its post of May 19, 2026, that it is adding Content Credentials verification so people can check whether content is an unaltered original from a camera or has been modified, and by what tools. It says that feature began rolling out in the Gemini app that day.

Does a file's name or type change what the checker reads?

Not in our tests. Our checker does not rely on a file name or a declared type; it reads the format from the bytes. We tested this on October 30, 2026, with a small number of files we made, so read the results as examples, not rates.

These are results about our checker and files we made. Our accuracy page lists the files we made to test forged and damaged records.

What do I do after the file check?

Search for earlier copies. The handbook points to Google Reverse Image Search and TinEye, and says the largest version of a picture usually leads to the original source. Our guide on reverse image search covers the tools we tested.

Then check that the photo shows what you were told. The handbook warns that an authentic picture can carry a wrong label, and gives a storm story in which a photo that spread widely had been taken a month earlier. It suggests looking for clues such as signs, landmarks and weather. It cautions that a timestamp in metadata can be a factory setting or another time zone, and that major social platforms strip most metadata on upload. Our guide on checking whether a photo has been edited covers what signals can and cannot show.

What this means when you check an image

Open the checker, choose the original file, and read the headline. Here are three you may see on a photo someone sent you. The line under every result is fixed: "These checks cannot determine whether an image is AI-generated."

"No supported provenance signals found". We found no signed record, no source label in the metadata and no Stable Diffusion watermark pattern. The line under it says this does not mean the image is real or human-made. Of the 32 real files in our test set, 29 came from Wikimedia Commons categories named "Images generated by ..." (uploaded by third parties), 2 were vendor samples and 1 was a C2PA test image. 16 of the 32 read this headline. Finding nothing therefore cannot settle a photo. Go on to the search for earlier copies and the check of context.

"Checks incomplete". Nothing was found, and a check could not run, so finding nothing says even less than usual. In our tests a 100 by 100 pixel PNG with no metadata reads this, because the watermark check is skipped below 256 by 256 pixels. Ask for a larger original.

"Metadata declares AI use". Unsigned metadata says the file came from a generative source. Under it we say: "Anyone can add or remove this; it is a label, not proof." Put it to the sender as a statement to test.

Guides on this topic

Frequently asked questions

Can a tool prove that a photo someone sent me is real?
No. The C2PA explainer says provenance information alone cannot tell you whether content is true. A tool can show signals in the file. You still need the sender's account and a search for earlier copies.
Does a photo with no metadata mean something is wrong?
Not by itself. OpenAI lists upload, download, editing, conversion and sharing among the ways metadata gets stripped, and the handbook says major social platforms strip most of it on upload. Ask for the original file.
Is a screenshot good enough to check?
It is better than nothing for the search and context steps. For the file's own signals it is weak: all 18 re-rendered copies of our 9 real files with a Content Credentials record read "No supported provenance signals found".
Is my photo uploaded when I use your checker?
No. The checks run in your browser. Our Privacy and method page explains how.