Media Provenance Inspector

Methodology and limits

What each check does, how strong the evidence is, and where it fails. Version 0.1.

Principles

How strong is each check?

Why "no indicators" is inconclusive

Most AI-made images and videos reach an investigator with no provenance data left. Converting an image to another format, exporting or re-encoding a video, taking a screenshot, or uploading to a platform all remove it. For this reason the tool reports "inconclusive" when nothing is found, and never "clean" or "authentic". Detecting AI content from the pixels or frames themselves is a different, error-prone problem that this version does not attempt.

SHA-256 hash

Strong for one purpose: showing that two copies of a file are identical. It says nothing about whether the content is real.

Content Credentials (C2PA)

Strong when the signature is valid, because the manifest is cryptographically signed by the tool or device that made it. This version only detects and reads the manifest. It does not validate the signature, so validate it with an official verifier before relying on it. A missing manifest means very little, because most files have none and many platforms strip them.

XMP and IPTC digital source type

Useful when it states that content is AI-generated or AI-composited. These fields are plain text inside the file and can be edited or removed by anyone.

PNG generation parameters

Some AI image tools write their prompt and settings into PNG files. When present they are a strong sign of how the image was made. They are removed when the image is re-saved, converted, or shared through most platforms.

EXIF and video container fields

Camera, software and date fields help build a timeline, but every one of them can be edited. A date inside a file is a claim, not a fact.

Tool names found inside the file

A weak indicator. A name can appear by accident, can be added on purpose, and shows that software touched the file, not what it changed.

Text markers

Hidden characters and chatbot artifacts are observable, but they can come from many sources and are easy to remove. They cannot establish who or what wrote a text.

What this site does not do

Handling evidence

Privacy

Files and text are processed in your browser and are not uploaded or stored by this site. The site is static, so there is no server-side analysis.