unsigned / is-this-image-ai
guide · provenance
How to check if an image was made by AI
Squinting at hands and counting fingers stopped working a while ago. The reliable signal is not visual at all: it is a signed record inside the file. Here is how to read it.
What Content Credentials actually are
C2PA Content Credentials are a cryptographically signed manifest embedded in the image. They record what made the file, what was done to it, and who vouches for that claim. Major generators and several camera makers now write them by default.
Because the manifest is signed, it is not something you can casually forge — you would need the signer’s private key. That makes a valid credential a much stronger signal than any visual tell.
The specific field that says “AI”
Inside the manifest, the field that matters is the IPTC digital source type. Three values mean a model produced the pixels:
- trainedAlgorithmicMedia — generated by a trained model.
- compositeWithTrainedAlgorithmicMedia — a composite that includes generated content.
- algorithmicMedia — produced algorithmically.
A fourth, algorithmicallyEnhanced, means a real photo that a model has altered — generative fill, AI denoise, and so on.
Unsigned reads that field and nothing else when it decides whether to say “AI provenance present”. It deliberately does not guess from the name of the tool that made the file, because a guess presented as a verdict is worse than no verdict.
No credential does not mean “not AI”
This is the honest limit of the method, and any tool that hides it is selling you something. Metadata is trivially easy to remove — that is literally the other half of what Unsigned does. Screenshot an AI image and the credential is gone. Re-save it in most editors and it is gone.
So the reading is asymmetric: a valid credential saying “AI-generated” is strong evidence. The absence of one is no evidence either way. Unsigned words its third verdict as “No credentials found” for exactly that reason — it reports what is in the file, not a conclusion about the world.
Checking an image yourself
Drop the file into Unsigned. If a manifest is present you will see who signed it, what tool made it, whether the signature validates, and — if it is declared — that the source type is AI. If there is no manifest, you will be told that plainly rather than given a confidence score that does not mean anything.
The whole check runs in your browser, which matters if the image is a leak, a legal exhibit, or anything else you should not be uploading to a third party while you assess it.