Skip to content
AQ Score
FREE · RUNS IN YOUR BROWSER

AI Image Checker: Read C2PA Content Credentials (OpenAI, Google, Adobe)

See whether an image carries signed Content Credentials, who signed them, which app wrote them, and whether they say the image was generated or edited with AI. The file is parsed on this page and never uploaded.

No uploadJPEG · PNG · WebPReads claims, does not validate signatures

Check an image for Content Credentials

JPEG, PNG or WebP. The file is read in your browser and never uploaded.

QUICK ANSWER

How to check if an image came from ChatGPT or OpenAI

  1. 1. Get the original file. Use the downloaded image, not a screenshot or a copy saved from social media; those usually lose metadata.
  2. 2. Read its Content Credentials here. Look at the signing certificate and the digital source type. “Generated by AI” with an OpenAI signer is what the credentials claim.
  3. 3. Validate the signature. Open the same file in Content Credentials Verify, or in OpenAI's checker at openai.com/verify, which its content provenance guide says checks C2PA credentials and SynthID in images.
  4. 4. Treat “nothing found” as unknown. OpenAI's guide notes that a not-detected result does not rule out AI generation, because editing or sharing can remove metadata.

For the background on both signals and what changed at OpenAI, read our guide: OpenAI SynthID check: how to verify C2PA and SynthID.

C2PA VS SYNTHID

Two different signals

  • • C2PA Content Credentials are signed metadata stored in the file (a JPEG APP11 segment, a PNG caBX chunk or a WebP C2PA chunk). Anyone can read them; this page does.
  • • SynthID is an imperceptible watermark that Google DeepMind embeds in the content itself. It can only be checked with Google's detector technology.
  • • Removal: metadata disappears with screenshots, many uploads and re-saves. OpenAI notes a SynthID watermark is part of the image itself and may survive some transformations.
  • • Who checks what: Google says its SynthID Detector (see Google DeepMind's SynthID page) checks content made with AI from Google or partners including OpenAI. Gemini's help page says the Gemini app currently recognizes SynthID only in content created by Google AI tools.
  • • Neither is a general AI detector. Both only confirm what a participating tool added. Absence of either signal proves nothing.
TROUBLESHOOTING

Why “no trusted C2PA manifest” happens

  • • The metadata was stripped. Screenshots, messaging apps, social networks, and “save as” in many editors drop the manifest.
  • • The image came from a different tool. OpenAI's checker only reports manifests that name OpenAI as the issuer and include an AI-generation action; a third-party manifest is reported as not detected.
  • • The manifest is present but not trusted. It may be signed with a test certificate, edited after signing, or damaged. This page still shows what it claims, so you can see the difference.
  • • The manifest is stored elsewhere. Some files reference a remote manifest in XMP; this page flags that case.
HOW IT WORKS

What this checker reads, and what it does not

It locates the C2PA manifest store (JUMBF), takes the active manifest, decodes the CBOR claim and assertions, and reads the subject of the leaf signing certificate from the COSE signature (shown as unverified, because anyone can put any name in a certificate). It also scans the actions of up to 50 earlier manifests in the same file, so an AI-generation record from before an edit is not hidden. Actions such as c2pa.created and their IPTC digital source type are translated into plain English, for example trainedAlgorithmicMedia → “Generated by AI” and compositeWithTrainedAlgorithmicMedia → “Edited with AI”. As a secondary hint it reads Iptc4xmpExt:DigitalSourceType from XMP, which is unsigned.

It does not verify the signature, hashes, timestamps or certificate trust list, and it cannot see SynthID. HEIC, AVIF and video files are not parsed locally yet. For full validation use Content Credentials Verify.

FAQ

Frequently asked questions

Can this tell me if an image was made with ChatGPT or another OpenAI model?

Only if the file still carries its C2PA Content Credentials. When it does, this page shows which names the signing certificate and claim generator give (not verified here) and whether the credentials, including earlier manifests in the file's history, record a generative-AI source. OpenAI's own checker at openai.com/verify also looks for a SynthID watermark, which this page cannot read.

Does this page detect SynthID watermarks?

No. SynthID is an invisible watermark inside the pixels, not file metadata, so it cannot be read by parsing the file. To check for SynthID, use Google's SynthID Detector (Google and partner content, including OpenAI) or, for Google-made images only, the Gemini app. For OpenAI images you can also use OpenAI's checker at openai.com/verify.

Why does a checker say it found no trusted C2PA manifest from OpenAI?

People report seeing a not-detected message along these lines when they check an image that OpenAI's checker does not recognize. OpenAI's documentation says its checker reports a detection only when a trusted or valid manifest names OpenAI as the issuer and includes an AI-generation action. A missing, invalid or third-party manifest gives a not-detected result. Usually the metadata was stripped by a screenshot, upload or re-save, or the image came from somewhere else. It is not proof either way.

If no Content Credentials are found, is the image human-made?

No. Most platforms and editing steps remove metadata, and many AI tools do not add C2PA at all. A missing manifest only means there is nothing to read in this copy of the file.

Is my image uploaded anywhere?

No. The file is read with your browser's File API and parsed in JavaScript on this page. No file data, file name or extracted value is sent to AQ Score, analytics or ad services.

Sources (checked October 18, 2026)