FREE / LOCAL / C2PA 2.4
Inspect one. Compare two. Audit a batch. Reproduce a report.
Read Content Credentials, compare provenance changes, review up to 2,000 files and reproduce an exported report without uploading any source asset. Integrity, signer trust and AI declarations remain separate observations.
A valid credential proves integrity of signed data, not factual truth. No credential does not mean fake.INSPECT / COMPARE / BATCH / REPRODUCE
A local workspace for evidence, not verdicts.
Inspect one file, compare two evidence states, review up to 2,000 files or reproduce an exported report. The 8.7 MB verifier loads only after a source file is selected.
Drop a file to inspect its Content Credentials.
Your file stays in this browser. No account, model call or remote trust list.
JPEG, PNG, WebP, GIF, AVIF, MP4, MOV, M4A or PDF / MAX 50 MBLOCAL INSPECTION RESULT
FILE
PLAIN-LANGUAGE READING / DETERMINISTIC
What this result means
EVIDENCE CROSSWALK
What the file supports and what remains unknown
ACTIVE MANIFEST
Signer and claim facts
DECLARED PROVENANCE / ORDER PRESERVED
Provenance timeline
Action order is preserved from the manifest. Action times are declarations, not trusted timestamps; only TSA status codes can mark a validated timestamp.
EVIDENCE INVENTORY
Actions, source types and ingredients
CREDENTIAL PATH / LOCAL VALIDATION
Certificate path and trust decisions
This is a sanitized evidence path, not the complete x5chain. The SDK exposes leaf-certificate summaries and validation codes but not intermediate certificate objects or the root trust-anchor object.
EXPERT MODESANITIZED TECHNICAL EVIDENCE / LOCAL ONLY
AI DISCLOSURE + SOURCE TYPES
VERIFIER + PRIVACY CONTRACT
CERTIFICATE + TRUST DIAGNOSTICS
BAGIT 1.0 / SHA-256 MANIFESTS / LOCAL
Export an interoperable Evidence Package
Creates a BagIt ZIP with the report, verifiable envelope, PROV-JSONLD and payload/tag manifests. This H/M profile is not an official C2PA package standard.
ENTERPRISE AUDIT / LOCAL / HASH-CHAINED
Create a review-ready audit record
Add optional case context, then export canonical JSON, print-ready HTML, Markdown, verification results and a SHA-256 manifest in one ZIP.
BEFORE / AFTER / LOCAL DIFF
Compare two evidence states without guessing why they changed.
The workspace compares hashes and sanitized C2PA observations. It reports what changed, not who changed it or whether the visible content is true.
BEFORE
No local file selected
AFTER
No local file selected
DETERMINISTIC EVIDENCE DIFF
Observed changes between two local reports
| OBSERVATION | BEFORE | AFTER | STATUS |
|---|
STRUCTURED MANIFEST DIFF
Changed manifest paths
| PATH | BEFORE | AFTER | CHANGE |
|---|
UP TO 2,000 FILES / MEMORY-BOUNDED / LOCAL
Audit a large local collection without creating an upload queue.
Files are processed one at a time, compacted immediately and shown 100 rows per page. Stop safely after the current file and export every processed row.
Drop files or choose a folder for a local batch review.
No local files selected
MAX 2,000 FILES / 50 MB EACH / NO UPLOADLOCAL BATCH OBSERVATIONS
One row per file, no aggregate verdict
| LOCAL FILE | MANIFEST | INTEGRITY | SIGNER | AI ORIGIN | READ |
|---|
EXPORTED REPORT + ORIGINAL FILE / LOCAL REPLAY
Reproduce a prior evidence report instead of trusting a screenshot.
Load a verifiable evidence envelope and the original source file. The workspace checks the envelope checksum, re-hashes the source and runs the pinned verifier again.
EVIDENCE ENVELOPE JSON
No local file selected
ORIGINAL SOURCE FILE
No local file selected
REPRODUCIBILITY CHECK / NO IDENTITY CLAIM
Current evidence compared with the exported report
| OBSERVATION | EXPORTED REPORT | CURRENT REANALYSIS | STATUS |
|---|
BROWSER SDK / DEVELOPER PREVIEW / 0.3.0
Put the evidence engine inside your own workflow.
Import one versioned ESM module for local inspection, provenance timelines, sanitized credential paths, Manifest Diff, 2,000-file batch review, evidence envelopes, BagIt packages and report reproduction. No API key and no source upload.
import { createContentCredentialsClient }
from "https://hogarmas.net/content-credentials/sdk/v0.3.0/index.js";
const client = createContentCredentialsClient();
const result = await client.inspect(file);
console.log({
integrity: result.report.integrity.state,
signerTrust: result.report.signer.state,
aiOrigin: result.report.aiOrigin.state,
timelineEvents: result.timeline.eventCount,
timestampTrust: result.trustDiagnostics.timestamp.state
});- Browser-local by contract
- The SDK sends no source bytes, metrics or browser-storage writes.
- Bounded at scale
- One file at a time, up to 2,000 files, with compact batch rows.
- Pinned and inspectable
- Versioned ESM, TypeScript declarations, runtime snapshots and SHA-256 manifests.
- Evidence, not verdicts
- No truth score or remote trust list. A sanitized credential path is exposed, not a complete certificate chain or compliance claim.
This H/M developer preview wraps @contentauth/c2pa-web 0.13.1. It is not an official C2PA SDK, conformance certificate or legal compliance service.
PROOF MODEL / NO THEATER
A credential is a chain of evidence, not a truth machine.
The verifier preserves each boundary so a valid signature cannot be mistaken for trusted identity, factual accuracy or proof that no AI was used.
- 01
Manifest presence
The file carries a readable C2PA manifest store. Missing credentials remain an absence, not a verdict.
- 02
Cryptographic integrity
The pinned CAI verifier validates claim signatures, hashed assertions and asset bindings.
- 03
Signer trust
Trusted, untrusted and unknown are shown separately. This local tool ships no remote trust list.
- 04
Declared provenance
Actions, ingredients, digital source types and AI Disclosure assertions are reported as signed claims.
LIMITS THAT MATTER
Do not turn provenance into a fake detector.
Does a valid credential prove the image or claim is true?
No. It can prove that signed manifest data and the bound asset have not changed in ways the validation catches. It cannot establish factual truth.
Does no credential mean fake or AI-generated?
No. A camera, editor or platform may never have added one, and metadata can be stripped. Absence cannot prove origin.
Why can integrity be valid while the signer is untrusted?
A signature can be mathematically intact while its certificate is outside the verifier's trust anchors. Identity trust is a separate decision.
Does this certify EU AI Act Article 50 compliance?
No. It surfaces machine-readable evidence inside one file. Visible disclosures, deployment context, exceptions and legal duties require separate review.