Watermark, metadata or fingerprint: three ways to tie a claim to an image
Metadata is information written into the file, a watermark is a hidden signal in the pixels, and a fingerprint is a code computed from the pixels and matched against stored copies. Each fails in a different place. The Content Authenticity Initiative says none is durable enough alone, and it describes combining all three.
What is the difference between a watermark, metadata and a fingerprint?
The Content Authenticity Initiative's post on durable Content Credentials (April 8, 2024) names these three techniques and defines each. Here are its definitions in our own words.
- Secure metadata. Verifiable information about how content was made, built into the file so that a change leaves evidence. It can be removed, by choice or by accident.
- Watermarking. In that post, hidden information that people cannot see, holding a small amount of data that a watermark detector reads.
- Fingerprinting. A code computed from the pixels, frames or sound of the content. It is matched against other copies, even after some change, and can be stored apart from the file. Nothing is embedded.
The post says "none of these techniques is durable enough in isolation". The C2PA explainer answers the same problem in its own terms. It says provenance metadata can be removed, and that "soft bindings" let a viewer discover a record that is no longer in the file. It says they can be built with an invisible watermark or a fingerprint lookup.
How do the three compare?
| Technique | Where the claim lives | What the sources say it does well | What the sources say it loses |
|---|---|---|---|
| Metadata | In the file, next to the pixels | Carries detailed information; a signed record shows evidence of change | Can be removed on purpose or by accident; OpenAI lists platforms, editing tools and file conversions |
| Watermark | In the pixels themselves | Can survive some changes that remove metadata, such as screenshots | Holds only a small amount of data; the CAI says it can be removed or spoofed |
| Fingerprint | In a database, computed from the pixels | Nothing in the file to remove | Matching is fuzzy, so a match is not certain |
A signed Content Credentials record is metadata with a signature. Our guide on Content Credentials versus EXIF, IPTC and XMP explains how signed and unsigned labels differ.
How does each one tie a claim to an image?
A signed record is tied by hashing: if the image bytes change after signing, the hashes stop matching. The C2PA explainer calls this a hard binding.
A watermark is tied by the pixels. A reader decodes a short identifier from the image, which the CAI post says can point to where the signed record is kept.
A fingerprint is tied by similarity. The code is recomputed from the image and compared with stored ones.
None of the three shows that a claim is true. The C2PA explainer says provenance information alone cannot tell you whether content is true, accurate or factual.
What happens to each one when a file is saved or edited?
The makers say each fails differently. OpenAI's help article on provenance signals says Content Credentials can be lost through everyday actions such as a screenshot or a file conversion. It says its SynthID watermark is designed to withstand common changes, and that heavy cropping or file compression can make a watermark undetectable. It describes combining the two so that each can address the other's limits. We do not check SynthID, so we cannot test those statements.
We can test the one invisible watermark our checker reads, the pattern that Stable Diffusion's reference software adds, and the signed records it reads. Our results:
| How the file was saved | Bits matched | Headline the checker gave |
|---|---|---|
| PNG | 127 of 136 | Known watermark pattern matched; source unconfirmed |
| JPEG, quality 90, no chroma subsampling (4:4:4) | 125 of 136 | Known watermark pattern matched; source unconfirmed |
| JPEG, quality 75, no chroma subsampling (4:4:4) | 126 of 136 | Known watermark pattern matched; source unconfirmed |
| JPEG, quality 75, usual 4:2:0 subsampling | 65 of 136 | No supported provenance signals found |
The same photo read "Known watermark pattern matched; source unconfirmed" as a PNG and "No supported provenance signals found" after a quality 75 JPEG save with 4:2:0 subsampling. The pattern was still there for the 4:4:4 saves and not for the usual 4:2:0 save. Our accuracy page has the full recall table: a PNG found 7 of 7 marked files, a quality 90 JPEG with 4:2:0 found 0 of 7, and resizing to 90% found 0 of 3. A watermark can survive some edits and not others.
Signed metadata fails in a different place. We changed 12 bytes of image data in a signed Adobe Firefly file, and in a signed Microsoft file. Both read "Content Credentials failed validation". On October 30, 2026 we also redrew each of the 9 real files that carry a record on a browser canvas and saved it again as a PNG and as a JPEG. None of the 9 kept its record, and all 18 outputs read "No supported provenance signals found". Of 20 marked watermark files, 19 still matched after a PNG redraw and 0 after a JPEG redraw. That test used a canvas, not a platform.Our guide to durable Content Credentials explains how a watermark and a fingerprint can lead back to a lost record. Our checker does not do that lookup.
Which one should a reader trust most?
None of them alone. A signed record gives the most detail while it stays in the file. A watermark can outlast a stripped file but carries little. A fingerprint needs a database that somebody keeps. A missing signal therefore says little. Our guide on whether AI watermarks can be removed covers what the sources and our tests say.
What this means when you check an image
Open the checker and choose the file. It reads signed records and unsigned metadata, and looks for one invisible watermark. It does not compute or look up fingerprints.
If you see "Known watermark pattern matched; source unconfirmed", the pattern that Stable Diffusion's reference software adds was found. Anyone running that software adds it, so it is not a signed record and does not say who made the file.
If you see "No supported provenance signals found", we found no signed record, no source label and no pattern we read. It does not mean the image is real or human-made. The signal may never have been added, may have been lost in saving or sharing, or may be one we do not read.
We do not check Google's SynthID, Meta's watermark or Adobe TrustMark; What is SynthID? explains where to check. Our limits line always applies: these checks cannot determine whether an image is AI-generated.
Guides on this topic
- What is SynthID? is the main page on this topic.
- Durable Content Credentials explains how the three work together.
- Invisible AI watermarks compared sets the makers' watermarks side by side.
- Can AI watermarks be removed? covers what the sources and our tests say.
- Content Credentials vs EXIF, IPTC and XMP covers the metadata side.
Frequently asked questions
- Is a watermark the same as Content Credentials?
- The Content Authenticity Initiative says Content Credentials are sometimes confusingly described as a type of watermark. It says watermarking means hidden information in the content, which is only one piece of its approach.
- Does our checker read fingerprints?
- No. Our checker reads signed records, unsigned metadata and one invisible watermark pattern. It does not compute a fingerprint or look one up.
- Why did one photo give two different results?
- The two files held different pixels. The quality 75 JPEG with 4:2:0 subsampling changed the fine detail where the pattern sits, and our checker no longer matched it. The PNG kept it.