# C2PA Credentials Inspector

> Read C2PA Content Credentials in images and videos: actions, AI hints, signer and signature. Upload an image or video and see its C2PA manifest store: claim generator, actions (created, edited, AI-generated digitalSourceType), ingredients, assertions and the signer certificate chain. The COSE signature over the claim, the assertion hashes and the JPEG/PNG/WebP data hash are verified offline; trust lists, revocation and time-stamps are not evaluated. XMP DigitalSourceType hints are read with ExifTool when available.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://c2pacredentialsinspector.usefulweb.site/ (interactive tool at https://c2pacredentialsinspector.usefulweb.site/tool)
- JSON API: POST https://c2pacredentialsinspector.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://c2pacredentialsinspector.usefulweb.site/api/v1/tool)
- OpenAPI: https://c2pacredentialsinspector.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://c2pacredentialsinspector.usefulweb.site/mcp - tool `c2pa_credentials_inspector`

## Inputs
- file (file, required): Image or video - JPEG, PNG, WebP, MP4/MOV, HEIF/AVIF or a .c2pa sidecar, up to 50 MB. Processed for this request only.
- useExiftool (boolean): Also read XMP/IPTC metadata hints with ExifTool (if installed)

## Method
- The container is detected from the file bytes: JPEG APP11 segments (JPEG XT “JP” header, multi-segment reassembly per ISO 19566-5 D.2), the PNG caBX chunk, the RIFF C2PA chunk (WebP), the ISO BMFF uuid box D8FEC3D6-1B0E-483C-9297-5828877EC481 (MP4, MOV, HEIF, AVIF), or a standalone .c2pa JUMBF file.
- JUMBF superboxes are parsed by their description boxes (type UUID + label); claims, assertions and the claim signature are decoded with our own CBOR decoder. The last manifest in the store is the active one; brotli-compressed manifests are expanded.
- Verified offline: (1) each hashed URI in the claim against the hash of the referenced assertion superbox (contents without the superbox header); (2) the c2pa.hash.data hard binding over the file bytes outside the exclusion ranges; (3) the COSE_Sign1 signature (detached payload = claim CBOR, empty external_aad) with the x5chain signer certificate (ES256/384/512, PS256/384/512, Ed25519); (4) that each x5chain certificate is signed by the next one.
- NOT evaluated: whether the signer chains to a trusted C2PA trust list, certificate revocation (OCSP), RFC 3161 time-stamps, BMFF/box hashes (c2pa.hash.bmff*, c2pa.hash.boxes: presence only), ingredient manifests’ own bindings and cloud/remote manifests. A valid signature therefore proves integrity and the signer key, not that the signer is trustworthy.
- AI hints: digitalSourceType values such as trainedAlgorithmicMedia or compositeWithTrainedAlgorithmicMedia in c2pa.actions, training-mining assertions, and (with ExifTool) XMP Iptc4xmpExt:DigitalSourceType. Missing credentials do not mean an image is authentic or human-made.

## Limits
- Signature validity is not trust: the signer’s certificate is not checked against a C2PA trust list. Absence of Content Credentials says nothing about authenticity.