Content Credentials and watermarks: what each one can tell you
The short answer
No tool can tell you with certainty whether an image was made by AI. What exists is five kinds of signal: plain metadata (EXIF, XMP, IPTC), signed Content Credentials (C2PA), invisible watermarks in the pixels, visible logos, and data hidden in pixel values. Finding one is evidence. Not finding one proves almost nothing, because screenshots, re-saves and uploads remove metadata and credentials, and a watermark check only works for the company that applied the mark.
People search for "how to tell if an image is AI generated" and hope for a button that says yes or no. No such button exists. What exists is a handful of signals that creators, cameras and generators can attach to an image. Each is read in a different way, and each can be lost or faked in a different way.
This guide lays them out side by side, so that when you see one (or none) you know how much weight to give it. Our image metadata viewer shows the first two kinds directly. The others need other tools, and we say which.
Five kinds of provenance signal
| Signal | Where it lives | Lost when the image is re-saved or screenshotted? | Can our viewer read it? |
|---|---|---|---|
| Plain metadata (EXIF, XMP, IPTC, text chunks) | Fields stored beside the pixels | Often lost on re-save, always lost in a screenshot | Yes |
| Content Credentials (C2PA) | A signed manifest stored in the file | Lost on most re-encodes and screenshots | Detects it and summarizes it. Does not verify the signature |
| Invisible watermark | Tiny changes to the pixel values | Designed to survive some edits, but not guaranteed | No |
| Visible watermark or logo | Drawn over the picture | Survives until cropped or painted out | No (you read it with your eyes) |
| Hidden pixel-level metadata | Bits hidden in pixel values, such as the alpha channel | Lost unless the pixels are untouched | Yes for the NovelAI format |
Plain metadata: EXIF, XMP, IPTC and text chunks
The simplest signals are ordinary fields. The EXIF Software tag names the program that last wrote the file, and XMP has CreatorTool for the same job. Stable Diffusion tools write a settings block into a PNG text chunk or an EXIF field, which we cover in our guide to reading prompts from generated images. Camera photos usually carry make, model and exposure data, explained in our guide to EXIF data.
A more formal signal is the IPTC Digital Source Type property, which lives in XMP. It takes a value from a published vocabulary, so software can state where an image came from. The most relevant values are:
| Value | Meaning |
|---|---|
digitalCapture | Captured from real life with a digital camera or recorder |
trainedAlgorithmicMedia | Generated by a model trained on captured content |
compositeWithTrainedAlgorithmicMedia | Edited with generative tools, for example inpainting or outpainting |
humanEdits | Corrected or enhanced with non-generative tools |
The full list is in the IPTC vocabulary. IPTC reported in 2024 that Google and Meta write trainedAlgorithmicMedia into images from their own generators, and Meta said it was also using invisible watermarks. The weakness of all plain metadata is the same: it is unsigned text. Anyone can delete it, copy it onto another file or type in a different value.
Content Credentials (C2PA)
Content Credentials is the public name for a standard from the Coalition for Content Provenance and Authenticity (C2PA). Its goal is tamper-evident provenance: a signed record of who made or changed an asset, and with what tools. As of October 2026, the steering committee listed on c2pa.org includes Adobe, Amazon, the BBC, Google, Meta, Microsoft, OpenAI, Publicis Groupe, Sony, TikTok and Truepic. Adobe started the related Content Authenticity Initiative in 2019.
What is inside a manifest
A C2PA manifest bundles several parts. Assertions are statements about the asset, such as the actions taken (created, opened, edited) and a hash that binds the manifest to the exact bytes of the file. A claim references those assertions and names the claim generator, meaning the software that built it. The claim is then signed with the signer's X.509 certificate. An action can also carry a digital source type, which is how a generator says "this was created from a model". The creator decides what to include, and naming a person is optional.
Our viewer reports that a manifest is present and shows the claim generator, actions and digital source type when it can read them, plus organization names found in the signing certificates. It does not check the signature.
Where it is stored
The specification gives each format a home. In JPEG, the manifest sits in APP11 marker segments. In PNG it is an ancillary chunk named caBX. In WebP and other RIFF files it is a chunk with the identifier C2PA. GIF uses an application extension block, and formats built on the ISO base media file format use boxes. So a re-encode or a metadata stripper deletes it: it is just another block of data next to the pixels.
Why it breaks, and what verifying means
The manifest includes a hard binding, a cryptographic hash over the asset's bytes. Change the pixels, or move the manifest onto a different image, and the hash no longer matches, so a verifier reports a problem. That is the tamper-evidence. It also means a screenshot, a resize or a convert-to-JPEG produces a file with no manifest at all, and OpenAI has said plainly that images without its C2PA metadata may or may not have come from its tools.
Checking a manifest properly needs a verifier that validates the signature and compares the signer against a trust list. Start with the official Content Credentials Verify tool. Even a valid result has limits. It says who signed the claims and that the file has not changed since. The Content Authenticity Initiative states that credentials are not meant to say whether content is "real", and Google notes that the security of any claim depends on the app and the operating system that made it.
A "durable" approach adds an invisible watermark and a fingerprint, so a stripped image can be matched back to a stored manifest. The CAI itself says no single technique is durable enough alone, and that watermarks can be removed or spoofed.
Invisible watermarks in the pixels
An invisible watermark changes pixel values slightly, in a pattern a detector can find but a person cannot see. It is not a metadata field, so a metadata viewer cannot read it, and stripping metadata does not touch it.
- SynthID. Google says SynthID embeds an imperceptible watermark in content from its generators, designed to withstand cropping, filters and lossy compression. You can check an image by uploading it to the Gemini app or Google's SynthID Detector portal. A 2025 paper describing the image system says it has been applied to over ten billion images and video frames across Google's services. A check only answers for SynthID, so "not found" says nothing about other tools.
- Digimarc. A commercial vendor. It describes an imperceptible watermark that can point to a C2PA manifest, so credentials can be recovered if the metadata is lost.
- The Stable Diffusion reference scripts. Stability AI's reference text-to-image script adds a small invisible watermark with the open-source
invisible-watermarklibrary. Whether a given app does the same varies.
Robustness is an open research question. A NeurIPS 2024 paper showed that "regeneration" attacks, which add noise to an image and rebuild it with a generative model, removed watermarks from the pixel-level schemes the authors tested. That says nothing about any one commercial system, but it is a reason to treat a surviving watermark as evidence and a missing one as inconclusive.
Visible watermarks and logos
Visible marks are the oldest signal. Microsoft has described a visible corner watermark on Bing Image Creator output, alongside C2PA-based credentials, and stock sites, agencies and artists use them too. They are easy to understand and easy to defeat: a crop or an inpainting pass removes them, and anyone can add a logo to a picture they did not make. Our viewer cannot read text drawn into the image, so this one is on you.
Hidden pixel-level metadata
Some generators hide a copy of their settings in the pixels themselves. NovelAI's open-source tools describe hiding data in the lowest bit of the alpha channel of a PNG, which survives a site stripping text chunks but not a re-encode. It is hidden metadata, not a robust watermark, since it vanishes when the pixels change. Our viewer decodes it, and the prompt-reading guide has the details.
What you found, and what it means
| What you found | What it suggests | What it does not mean |
|---|---|---|
| Camera make, model and exposure in EXIF | The file carries camera-style metadata | That the picture is genuine. Fields can be copied or typed in |
Software names an editor | That program last saved the file | Anything about whether the content was generated |
| A prompt and settings block | A generation tool probably wrote the file | That nobody edited the pixels or the text afterward |
Digital Source Type trainedAlgorithmicMedia | Software or a person declared it generated | That the claim is signed or verified |
| C2PA manifest present | A signer made claims about the file | That the claims are true, or that the signature is valid (our viewer does not check) |
| No C2PA manifest | Nothing | That the image is a camera photo. Most images never had one |
| No metadata at all | It was stripped or never present | Any conclusion about origin |
| Vendor detector finds its watermark | Strong evidence that vendor's tool was involved | That the image is entirely generated, or untouched since |
| Vendor detector finds nothing | Nothing about other tools | That the image is human-made |
| Visible logo | A claimed source | That the claim is true |
How to answer "was this made by AI?"
- Get the original file. A screenshot or social media copy has usually lost its metadata and credentials.
- Read the metadata. Open the file in the metadata viewer and look for generation data, a generator name, Digital Source Type and a Content Credentials flag.
- Verify credentials if they exist. Use Content Credentials Verify, not our summary, before trusting a manifest.
- Ask the likely vendor. Midjourney says every image it delivers carries a hidden ID tag and offers a checker at midjourney.com/verify, and warns that a missing tag does not mean Midjourney did not make the image. Google offers a SynthID check.
- Check the context. Where did it first appear, and are there earlier or higher-resolution copies?
- Word your conclusion carefully. "This file carries credentials from tool X" is a finding. "This is fake" usually is not.
Metadata is also gone when someone removes it on purpose, for instance with a tool like our image metadata remover, which strips EXIF, XMP, text chunks and Content Credentials without re-encoding the pixels. A clean file may simply have been cleaned for privacy, so a missing manifest or prompt says nothing about whether an image was generated.
Adding credentials and keeping copyright data
If you publish images, you can make your own provenance easier to check. Keep the creator and copyright fields in your files, and check what your website or platform does to them, because many strip them on upload. Some tools can add signed credentials. Adobe's Lightroom offers an Apply Content Credentials option on export, where you choose what to include, such as your name, connected social accounts and edit history. The Leica M11-P, released in October 2023, was announced as the first camera to sign each photo with Content Credentials, and Google says its Pixel 10 phones attach them to JPEG photos from the Pixel Camera app.
Credentials and copyright data share a trade-off with privacy. Removing all metadata is the right choice before you post a photo from home, as our guide to removing location data from photos explains, but it also removes your authorship and any credentials. Decide which matters more before you publish.
See the EXIF, GPS location, copyright, Content Credentials and generation settings hidden inside any image, then export them as JSON or CSV. It runs in your browser. Open the Image Metadata Viewer.
Frequently asked questions
Do screenshots keep Content Credentials?
No. A screenshot is a new image made from the screen's pixels, so the signed manifest in the original file is not carried over. OpenAI and Midjourney both warn that screenshots and many social sites remove their provenance data.
Is SynthID the same thing as Content Credentials?
No. SynthID is an invisible watermark inside the pixels, and Google's detection tools look for it. Content Credentials are a signed record stored in the file next to the pixels. They answer different questions and fail in different ways, though the durable approach uses both together.
Can someone fake Content Credentials?
Copying a manifest onto another image should fail the hash check. But anyone can sign a manifest of their own with their own certificate, and the claims in it are only as honest as the signer. That is why verifiers compare the signing certificate against a trust list, and why a valid signature is not proof that a claim is true.
Can your viewer detect an invisible watermark or tell me an image is generated?
No. It reads metadata, so it cannot detect invisible pixel watermarks such as SynthID or Digimarc, cannot read visible watermark text, and cannot tell whether an image was generated when the metadata is missing. It reports what the file declares about itself and nothing more.