ozDNA / Learn / Verifying a content record

How to Verify an AI Content Record: Hashes, Signatures and Timestamps

Published October 16, 2026 · Last reviewed October 16, 2026
By Ebru Ozpolat · KOLAXA YAZILIM TEKNOLOJİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ

A content record is the evidence written down when a piece of content is made or registered. It might be embedded in the file, as with C2PA Content Credentials, or held in a registry. Either way, verifying it comes down to the same building blocks. This guide explains what each one proves, the order to check them in, and how to read the results.

The four building blocks

Content hashing: is it the same file?

A cryptographic hash such as SHA-256 turns a file into a fixed 256-bit fingerprint of its exact bytes. Change one pixel and the hash comes out completely different. Finding a different file with the same hash is not practical. That makes the hash the simplest check: if your file's SHA-256 matches the one in the record, you have the same file, byte for byte.

The same strictness is the weak point. Most platforms re-encode images on upload, so the copy you find online almost never has the original's hash. A hash mismatch alone does not mean the content was manipulated. It usually just means "this is not the original file".

Perceptual fingerprints: is it the same image?

A perceptual hash summarises what an image looks like instead of its bytes, so a resized, recompressed or stripped copy still produces a nearly identical fingerprint. One common method, dHash, shrinks the image, compares the brightness of neighbouring pixels and records the result as 64 bits. Two fingerprints are compared by counting the bits that differ (the Hamming distance). A small distance means the same picture.

This is what makes provenance survive the real web. If the embedded metadata is gone, a registry that stored the original's fingerprint can still link a copy back to its record. Fingerprints have limits: heavy crops, mirroring or overlays can push the distance past a match threshold, and two different images that look alike can occasionally come out close. Treat a fingerprint match as "same image, probably". Then use the original file's hash and signature for the strong claims.

Digital signatures: who vouched for it, and has it changed?

A digital signature is made with a private key and checked with the matching public key. A valid signature proves the record was signed by whoever controls that key, and that neither the record nor the content it binds has changed since. In C2PA, the signature covers the manifest, and the manifest includes a hash of the content, so editing either breaks it.

Two questions remain after the math checks out:

• Whose key is it? Signatures come with a certificate naming the signer. A validator checks that certificate against a trust list. A valid signature from an unlisted certificate is often shown as an "unknown source". That is a question about identity, not about tampering.
• Was the key valid at the time? Certificates expire and can be revoked. A trusted timestamp on the signature shows it was made while the certificate was still good.

Timestamps: when did it exist?

A timestamp shows that a record existed no later than a given moment. A date someone typed into a file can be changed by anyone. A verifiable timestamp has to come from somewhere the creator does not control. There are two common ways to do that:

• A timestamp authority, as defined in RFC 3161. A third party signs the hash together with the time. You trust that authority's clock and key.
• A public, append-only record. The hash, often batched with others, is written to a log that cannot be rewritten after the fact. Anyone can check that the hash is included, without trusting the operator.

A timestamp proves "existed by", not "created on". Content registered today may have been made last year, and a timestamp says nothing about who made it.

Step by step: verifying a record

1. Get the closest-to-original file you can. Download the file itself instead of taking a screenshot. A screenshot is a new file with no record.
2. Look for an embedded record. Check for a C2PA manifest. If one is present, validate its signature, certificate and content hash with a C2PA validator.
3. Compute the SHA-256 hash and look it up in the registry or record you are checking against. A match means this is the registered file.
4. If the hash doesn't match, compare perceptual fingerprints. A close match means a modified copy of a registered image, for example after re-encoding. A far one means no link.
5. Check the timestamp independently. Verify the timestamp authority's signature, or confirm the hash's inclusion in the public record, without relying on the operator's word.
6. Write down what was proven, and only that. For example: "Same image as a record signed by X and timestamped by date Y." Avoid stretching it to "this is real".

What the ozDNA verify page checks today

The ozDNA verify page runs the first steps in your browser, and the image never leaves your device:

• SHA-256 content hash, computed with the browser's Web Crypto API;
• 64-bit dHash perceptual fingerprint, computed from the pixels;
• a re-encode test, which recompresses the image the way a platform would to show the hash changing while the fingerprint barely moves;
• a C2PA manifest presence scan, with full cryptographic validation in the separate deep verify app;
• a registry lookup, which sends only the SHA-256 hash, not the image, to the OriginDNA registry and returns the recorded "existed by" time if the hash is registered.

What a passing check does not tell you

• Whether the content is true. A perfectly verified record shows origin and integrity, not accuracy. See content authenticity vs factual accuracy.
• Whether the signer told the truth. A signed "made with a camera" claim is as reliable as the signer.
• Anything about content with no record. No match means nothing to check, not "fake".

Sources

• FIPS 180-4, Secure Hash Standard (SHA-256), NIST
• RFC 3161, Time-Stamp Protocol, IETF
• C2PA technical specifications, Coalition for Content Provenance and Authenticity

Keep reading

• What Are Content Credentials? A Practical Guide to C2PAThe embedded-record side: manifests, trust lists and validators.
• Content Provenance vs AI DetectionWhy a record beats a guess, and what neither can prove.