Provenance is evidence, not a vibe check

Four different things people collapse

• C2PA / Content Credentials — signed manifests bound to the file. Can survive some edits and fail others. A trusted official result is a strong file-level signal, not a pixel oracle.
• SynthID and similar watermarks — designed to live in pixels. A metadata stripper cannot read or remove them. Official OpenAI verification may report SynthID for supported assets after you choose to upload.
• Ordinary metadata — EXIF/XMP/PNG text, software tags, prompts stuffed in comments. Easy to delete or fake.
• Visual classifiers — “this looks AI”. They are not implemented here as a score, and they are not C2PA.

Trusted positive vs missing

A trusted positive from official OpenAI C2PA/SynthID, after you click verify, is evidence about that API’s view of that file. Local inspection showing a C2PA/JUMBF structure is a clue you can screenshot for yourself.

A miss means this scan did not find the field. The image may still be synthetic, the credential may have been stripped, the watermark may be unsupported, or the file may be a screenshot.

Screenshots and recompression

A screenshot is a new raster. C2PA almost always dies. EXIF is usually gone or replaced by the phone. Pixel watermarks may degrade. Treat screenshot provenance as weak unless an official verifier still reports a supported watermark.

Walkthrough: what survives a screenshot.

Workflow in this kit

• Local pass in AI Image Origin Detector — no file upload.
• If you need OpenAI’s official C2PA/SynthID result, click verify. That path sends the image through our Worker to OpenAI.
• If you needed a sharing copy without credentials, that is Metadata Cleaner, and it still will not erase SynthID.
• Read ChatGPT image checks and C2PA checks before treating a UI badge as proof.