c2pa-verifier 0.10.0 · demo

Check the Content Credentials of an image, a recording or a text

Pure PHP, running in your browser through WebAssembly: no server and no c2patool involved. Your file never leaves your device. The verdict uses the same terms as c2patool, the command-line tool from the Content Authenticity Initiative: Valid, Invalid or Trusted, with the C2PA status codes. It has been measured against it; where this verifier is stricter, the comparison says why.

Your file

Drop a file here or choose a file

JPEG, PNG, GIF, WebP, MP4, MOV, AVIF, HEIC, WAV, MP3, FLAC, AVI, plain text · up to 50 MB

Loading PHP…

Or try a sample

Trust list

NoneThe signature is checked, but no signer is trusted. c2patool's test rootsThe public test certificates from contentauth/c2patool. For demonstration only. Google's Pixel camera CAsThe two intermediate CAs that sign Pixel photos and their timestamps. The file does not carry Google's root, so these two serve as anchors.

Ed25519 signatures cannot be checked in the browser build (no sodium); they show as algorithm.unsupported.
Revocation is never fetched: no network during verification.
Plain text (C2PA 2.4 §A.8) is experimental in c2pa-rs; a text is hashed byte for byte, so one changed quote or line ending makes it Invalid.

Choose a sample or drop a file.

Use it on your own server: composer require provemark/c2pa-verifier PHP 8.3+, ext-openssl, no binary, no extension beyond the standard ones.

PHP runs through php-wasm 3.1.55 (GPL-2.0-or-later). Sources and licences: NOTICES.md.