usefulweb.site C2PA Credentials Inspector

Security & supply-chain explorers

C2PA Credentials Inspector

Read C2PA Content Credentials in images and videos: actions, AI hints, signer and signature.

JPEG, PNG, WebP, MP4/MOV, HEIF/AVIF or a .c2pa sidecar, up to 50 MB. Processed for this request only.

Try an example: Synthetic AI-generated JPEG with a signed manifest · Synthetic PNG with a caBX manifest

How it works

Upload an image or video and see its C2PA manifest store: claim generator, actions (created, edited, AI-generated digitalSourceType), ingredients, assertions and the signer certificate chain. The COSE signature over the claim, the assertion hashes and the JPEG/PNG/WebP data hash are verified offline; trust lists, revocation and time-stamps are not evaluated. XMP DigitalSourceType hints are read with ExifTool when available.

  • The container is detected from the file bytes: JPEG APP11 segments (JPEG XT “JP” header, multi-segment reassembly per ISO 19566-5 D.2), the PNG caBX chunk, the RIFF C2PA chunk (WebP), the ISO BMFF uuid box D8FEC3D6-1B0E-483C-9297-5828877EC481 (MP4, MOV, HEIF, AVIF), or a standalone .c2pa JUMBF file.
  • JUMBF superboxes are parsed by their description boxes (type UUID + label); claims, assertions and the claim signature are decoded with our own CBOR decoder. The last manifest in the store is the active one; brotli-compressed manifests are expanded.
  • Verified offline: (1) each hashed URI in the claim against the hash of the referenced assertion superbox (contents without the superbox header); (2) the c2pa.hash.data hard binding over the file bytes outside the exclusion ranges; (3) the COSE_Sign1 signature (detached payload = claim CBOR, empty external_aad) with the x5chain signer certificate (ES256/384/512, PS256/384/512, Ed25519); (4) that each x5chain certificate is signed by the next one.
  • NOT evaluated: whether the signer chains to a trusted C2PA trust list, certificate revocation (OCSP), RFC 3161 time-stamps, BMFF/box hashes (c2pa.hash.bmff*, c2pa.hash.boxes: presence only), ingredient manifests’ own bindings and cloud/remote manifests. A valid signature therefore proves integrity and the signer key, not that the signer is trustworthy.
  • AI hints: digitalSourceType values such as trainedAlgorithmicMedia or compositeWithTrainedAlgorithmicMedia in c2pa.actions, training-mining assertions, and (with ExifTool) XMP Iptc4xmpExt:DigitalSourceType. Missing credentials do not mean an image is authentic or human-made.

Signature validity is not trust: the signer’s certificate is not checked against a C2PA trust list. Absence of Content Credentials says nothing about authenticity.

Sources

For scripts and AI agents

  • JSON API: POST https://c2pacredentialsinspector.usefulweb.site/api/v1/calculate (same calculation as this page)
  • Interface description: OpenAPI 3.1 · AI guide: llms.txt
  • MCP server (Streamable HTTP): https://c2pacredentialsinspector.usefulweb.site/mcp · tool name c2pa_credentials_inspector
Example request
curl -s -X POST https://c2pacredentialsinspector.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{…see OpenAPI examples…}'

Related tools

Feedback