How to Check if an Image Is AI-Generated (Content Credentials)
You cannot reliably tell whether an image is AI-generated just by looking at it — and, despite the marketing, neither can the “AI detector” tools that guess from the pixels. The honest, durable way to answer the question is to read the provenance an image carries: a signed record of how it was made and edited. Here is how to inspect an image’s Content Credentials and metadata, privately, in your browser — and how to read the result without fooling yourself.
The tool
Content Credentials Inspector
Step by step
- Open the inspectorGo to the Content Credentials Inspector — it reads the file on your device and never uploads it.
- Upload the imageDrop in a JPG, PNG, WebP, or AVIF image you want to check.
- Read its credentialsThe tool shows any embedded Content Credentials — whether AI was involved, which tool created or edited it, who signed it, and its edit history — alongside camera and software metadata from EXIF.
- Interpret it honestlyIf credentials are present, you have learned something verifiable. If there are none, the tool says so plainly instead of guessing whether the image is real or AI.
What Content Credentials are
Content Credentials are a tamper-evident record — built on the open C2PA standard, promoted by the Content Authenticity Initiative — attached to an image that describes where it came from: who or what created it, which tools edited it, and whether generative AI was involved. The record is cryptographically signed, so if the image or its history is altered afterwards, the signature no longer matches and the tampering shows.
Adobe, Microsoft, OpenAI, Google, and a growing list of camera manufacturers are attaching these credentials to photos and AI outputs, which is why reading them is becoming a practical way to check an image’s history.
Why “AI detectors” that read pixels fail
Tools that claim to spot AI images by analysing the pixels are guessing at statistical fingerprints, and they get less reliable every time image models improve — it is an arms race the detector always loses, producing confident-sounding false positives and false negatives. Reading declared provenance is a fundamentally different thing: it is a signed statement carried by the file, not a probability squeezed out of the pixels. When it is present it actually means something; when it is absent, an honest tool admits it does not know.
What “declared” means — and its limits
This tool reports what the file declares about itself. That is powerful when a credential is present and its signature checks out: you can trust that, say, an image was produced by a particular AI tool or edited in a particular app. But provenance describes the recorded history, not a verdict on reality — a credential can be missing, and plain EXIF metadata (unlike signed C2PA) can be edited. So treat present, signed credentials as strong evidence, and treat their absence as “unknown,” never as proof either way.
When there are no credentials
Most images on the web today still carry no Content Credentials, and that is completely normal — social platforms and messaging apps routinely strip metadata on upload, and older or re-saved images never had any. Their absence does not mean an image is fake, and it does not mean it is genuine; it only means no provenance was recorded or it was removed along the way. The tool is deliberately honest about this rather than inventing a confidence score, which is exactly why you can trust what it does report.
How to use it in practice
When you receive an image you want to vet — a “leaked” photo, a product shot, a piece of news media — run it through here first. If it carries signed credentials, read them: they may tell you it was AI-generated, or that it came straight from a specific camera, or which edits were applied. If it carries none, fall back to the ordinary checks — source, context, corroboration — rather than trusting any single-click “real or fake” claim, because no tool can give you one reliably from pixels alone.
Frequently asked questions
Does it detect AI from the pixels?
No — and that is deliberate. It reads declared Content Credentials and metadata, which are records carried by the file, rather than guessing from pixels the way unreliable “AI detectors” do. If none are present, it tells you honestly instead of inventing a verdict.
What is C2PA?
C2PA (Coalition for Content Provenance and Authenticity) is the open standard behind Content Credentials — a signed, tamper-evident way to record how a piece of media was created and edited. It is backed by Adobe, Microsoft, OpenAI, Google, and camera manufacturers.
Why do most images show nothing?
Content Credentials are still being adopted, and many platforms strip metadata when you upload. So most images do not carry provenance yet — and missing credentials are not a verdict either way, only “no record found.”
Can Content Credentials be faked or removed?
They can be stripped, which simply leaves no record, but not silently altered — the cryptographic signature breaks if the content or its history is changed, which is what makes a present, valid credential trustworthy.
Is my image uploaded to check it?
No. The file is read on your device and the provenance is parsed locally; nothing is sent to a server.