Every registered image carries two live proofs — an anchored timestamp no one can backdate and a perceptual fingerprint that survives stripped metadata — and, once signing ships, a cryptographic signature. This is our own verify page — it needs no account, and it does not depend on anyone's trust list. Recomputing happens in your browser; the image never leaves your device.
Or choose a file. Everything runs locally — nothing is uploaded.
v1 supports images (JPG / PNG). Hashing, the perceptual fingerprint and the re-encode test all run in your browser — we never receive the file.
The exact-bytes fingerprint. Flip a single pixel and it changes completely. Computed with the Web Crypto API.
A fingerprint of what the image looks like, not its bytes — computed live from the pixels on a canvas.
We recompress the image the way a social platform would, then re-check. The content hash changes entirely; the perceptual fingerprint barely moves.
We scan the file bytes for an embedded C2PA manifest. Full cryptographic validation runs in the deep verify app.
Looks up your content hash in the OriginDNA registry (no upload of the image — hash only). Set window.__OZDNA_API__ or defaults to https://api.ozdna.com.
Hash, fingerprint, re-encode test and C2PA presence run in your browser — the image is not uploaded. Registry lookup sends only the SHA-256 hex to the API when reachable.
Once signing ships, the C2PA signature binds the manifest to the pixels: if the image was edited after signing, the signature no longer matches. Today this page checks whether a C2PA manifest is present; full validation runs in the deep verify app.
The fingerprint is written into a public, append-only record with a batch timestamp — that lookup works today. The proof that lets anyone check the "existed by" date independently, without us, is planned: the API's proof endpoint still returns an empty proof array.
Platforms strip metadata on upload. The perceptual fingerprint doesn't live in the metadata, so a stripped copy still resolves back to its registered original.
OriginDNA will sign to the open C2PA standard (signing is planned), and such a signature will be cryptographically valid. But until we complete the C2PA Conformance Program, our certificate is not on the interim trust list — so tools like the official Content Credentials Verify may label the source "unknown." That is about membership, not about whether the file was tampered with.
So we run our own verify page and anchor every fingerprint in a public record that needs no one's trust list. We do not claim "trusted Content Credentials" — and we won't until it is true. Provenance you can check yourself beats a badge you have to take on faith.
No. The content hash is computed in your browser with the Web Crypto API. In the full product, signature reading and fingerprint matching run client-side too — the image stays on your device.
No — deliberately. Detection guesses after the fact. Verification checks proofs that were attached at creation. Provenance, not detection.
That's the case the fingerprint is built for. The perceptual fingerprint isn't stored in the file's metadata, so a stripped or re-encoded copy can still be matched back to its registered original.
Neither. Verification is public and account-free. There is no token and none is planned; we never touch user funds.
v1 is images — JPG and PNG. Video, audio and mobile come after the core is solid.
What does each check prove? How to verify an AI content record: hashes, signatures and timestamps.