Privacy and method

The checks run in your browser. Your image, its file name and its metadata are not uploaded, and the page makes no request except to our own domain. This page says exactly what the page does, how it reaches its results, which trust lists it uses, and what it leaves unchecked.

What the page does and does not do

• It reads your image on your device. The page reads the file into memory in your browser. The preview you see is made by your browser from that file.
• It uploads nothing. A Content Security Policy sent with every page limits network requests to our own domain, so a script or a crafted image cannot make your browser send data to another site.
• It loads only files from our domain. That means the page, its stylesheet and scripts and, when you add your first image, a WebAssembly module of the open-source c2pa library (about 9 MB, about 3.2 MB compressed) and the trust lists. There are no outside fonts, scripts or images.
• It has no analytics and stores nothing. We set no cookies and write nothing to your browser's storage. Results live in memory and are gone when you close or reload the tab.
• It never fetches what a file points to. Some files name a record stored online. We never request it.

Like any website, loading ours sends a normal request to our host, Cloudflare, which sees what any web host sees, such as your IP address and the page you asked for. We add no analytics on top of that. If you follow a link to another company's detector and upload a file there, that upload goes to them under their terms.

How a check works

1. Metadata. A reader we also use on gotalt.com lists what the file declares in IPTC, XMP, EXIF, PNG text and embedded C2PA claims. Nothing is validated at this step, so every item is a declaration.
2. Content Credentials. The c2pa library (@contentauth/c2pa-web 0.15.5, MIT licence) validates the signature, the match to the file and the signer's certificate. It first uses the C2PA Trust List. If only the signer's credential fails, it tries the Interim Trust List. It judges the file's own record on its own: a problem in the record of an earlier version the file was made from is reported about that earlier version, and only a changed image in an earlier version fails the whole file. Remote record fetching and online certificate status checks are switched off. A pass that takes more than 20 seconds is reported as incomplete.
3. Stable Diffusion invisible watermark. For images of at least 256 by 256 pixels, a decoder ported from the MIT-licensed invisible-watermark project compares the recovered bits with known payloads. It reports a match only above a threshold we set by testing 250 real photographs in Chrome (none came close), placed where a chance match is less likely than one in a billion, and a payload that could not reach a safe threshold is not offered. The watermark survives lossless files; ordinary JPEG compression, resizing and cropping remove it, so "not found" means little for a shared image. A format your browser cannot decode is reported as skipped, never as "not found".
4. Headline. Fixed rules turn the results into one line. The first rule that applies wins and every other finding stays listed beneath it.

Files over 50 MB are refused, and so are SVG, PDF and anything that is not JPEG, PNG, WebP, AVIF, HEIC, HEIF or GIF.

How the headline is chosen

In priority order, the headlines are:

1. Unable to check this file
2. Content Credentials failed validation
3. Trusted Content Credentials declare AI use; Trusted Content Credentials declare another source; Trusted Content Credentials found
4. Content Credentials found; legacy trust-list match
5. Content Credentials found; signer trust not established
6. Content Credentials are not available locally
7. Content Credentials check incomplete
8. Source declarations conflict
9. Known watermark pattern matched; source unconfirmed
10. Metadata declares AI use; Metadata declares another source; Tool name found in metadata; Metadata found; source not established
11. Checks incomplete
12. No supported provenance signals found

A failed validation outranks any positive finding, and an incomplete check outranks an absence. "AI" appears only inside a claim attributed to a signer or to metadata. Every result ends with this line: "These checks cannot determine whether an image is AI-generated."

The two trust lists and their dates

The C2PA Trust List is the one that earns the word "trusted" here. The Interim Trust List is a second, legacy check, and a match is labelled that way. Each result names the list it used and shows the date. We check against these copies only and never fetch a list at check time from anywhere else. We never add trust anchors of our own, because that would make us the party vouching for a signer.

Why files from OpenAI read "signer trust not established"

Our copy of the C2PA Trust List has no certificate with OpenAI as the subject, and in our October 27, 2026 test the Interim Trust List did not trust OpenAI's certificates either. We ran three OpenAI-signed sample files. The newest, with a certificate that names "OpenAI OpCo, LLC", had a valid signature, but neither list accepts its certificate. The two older files, with a certificate that names "OpenAI", carried certificates that had expired.

We show such a file as "Content Credentials found; signer trust not established", not as "failed validation", because the record itself is intact. The headline does not say the record is forged, and it does not say it is genuine. It cannot: anyone can make a certificate with any name, including one that names OpenAI, and only a trust list vouches for a certificate. A genuine OpenAI file and a file signed with a self-made certificate therefore read the same here. For that reason the result says "The signing certificate names ..." and never "Signed by ..." unless a trust list vouches for the certificate, and it says "The image matches this record", not that the image is unchanged since the signer signed it. To confirm a file from OpenAI's tools, use OpenAI Verify. Microsoft and Adobe files behaved differently: in the same test they were trusted only on the Interim Trust List. See What are Content Credentials?

What we do not check

• Revocation. We do not ask online whether a signing certificate has been revoked since it signed a file, because that would be a request from your browser to a third party. A certificate revoked after signing can still pass here.
• Remote records. A file that points to an online record gets the headline "Content Credentials are not available locally", with a pointer to Adobe Inspect.
• Other signals. Not checked here: Google's SynthID watermark (also used by OpenAI, NVIDIA and Kakao), Meta's watermark, Adobe TrustMark, visible marks and pixel-based AI detection. See What is SynthID? and visible AI watermarks.

Other tools and credits

The same team runs GotAlt. Its AI image metadata checker reads AI declarations for up to 50 files at once, in the browser. It reads claims only and does not validate signatures. For the whole picture, read How to tell if an image is AI.

Contact

Questions, corrections and trust list reports: hello@newwatermark.com. Please do not email images. We do not receive or keep yours, so we cannot retrieve or delete one.

Frequently asked questions

Is my image uploaded?

No. It is read and checked in your browser, and the page may only contact our own domain. The footer of every page says so, and the checker is built to match.

Does the site use cookies or analytics?

No. We set no cookies, run no analytics and store nothing in your browser.

Can I use the result as evidence?

No. The checker is not for legal or evidentiary use, and it cannot determine whether an image is AI-generated.

What do the trust list dates mean?

They show how current our copy of each list is. A signer added to a list after that date will not be recognised until we refresh our copy.