Check what a file carries.

C2PA File Verification Overview

Drop any media file into Lens Proof Check to inspect embedded Content Credentials and provenance manifests. The validator decodes binary JUMBF (ISO/IEC 19566-5) containers, cryptographic COSE signatures, assertion stores, and historical ingredient trees. Single local media files up to 4 GB or batches of up to 20 files at 50 MB each can be verified in a single browser session.

Content Credentials allow creators, journalists, institutions, and consumers to establish the origin and edit history of digital media. By inspecting the active manifest and assertion store, Lens Proof Check exposes detailed provenance data, including capture timestamps, device hardware attributes, GPS coordinates, editing tool actions, and cryptographic signing certificate chains.

JUMBF Box Architecture & C2PA Manifest Store

Lens Proof Check parses binary JPEG, PNG, HEIC, MP4, MOV, and PDF containers to extract JUMBF (JPEG Universal Metadata Box Format) structures. The validator navigates the manifest store graph, examining the following primary C2PA boxes:

• Active Manifest Box (c2pa) — The top-level provenance container describing the final state of the media asset.
• Claim Box (c2pa.claim) — Cryptographic claim header containing hashes of all assertion instances, metadata bindings, and claim generator attributes.
• Claim Signature Box (c2pa.signature) — COSE (CBOR Object Signing and Encryption) signature structure binding the claim header to an X.509 certificate chain.
• Assertion Store (c2pa.assertions) — Collection of metadata assertions, including c2pa.actions (edit history), c2pa.hash.data (pixel/asset hash bindings), and stbi.c2pa.hardware (sensor capture evidence).
• Ingredients Box (c2pa.ingredient) — Parent or source asset references representing composite layers, edit inputs, or historical versions.

Cryptographic Algorithms & Signature Verification

Lens Proof Check validates COSE signature blocks using standard public-key cryptography and secure hash primitives:

• ECDSA P-256 (ES256) — Elliptic Curve Digital Signature Algorithm using the secp256r1 curve and SHA-256 digest, widely used by hardware security modules and camera signers.
• Ed25519 (EdDSA) — High-speed Edwards-curve Digital Signature Algorithm providing 128-bit security for lightweight mobile capture applications.
• RSASSA-PSS (PS256) — RSA Signature Scheme with Appendix - Probabilistic Signature Scheme using 2048-bit or 4096-bit RSA keys and SHA-256 digests.
• RFC 3161 Timestamp Proofs — Independent Time-Stamp Authority (TSA) signatures verifying the exact UTC time at which a C2PA claim was generated.

Supported Media & Document Formats

Lens Proof Check supports local verification across a comprehensive matrix of image, video, audio, and document formats:

• Still Images: JPEG (.jpg, .jpeg), HEIC/HEIF (.heic, .heif), PNG (.png), WebP (.webp), AVIF (.avif), TIFF (.tif, .tiff), BMP (.bmp), GIF (.gif).
• Video Assets: QuickTime MOV (.mov), MP4 (.mp4), WebM (.webm), M4V (.m4v).
• Audio Recordings: MP3 (.mp3), M4A (.m4a), WAV (.wav), OGG (.ogg), FLAC (.flac), AAC (.aac).
• Documents & Manifest Sidecars: PDF (.pdf) documents and standalone .c2pa manifest files.

Every supported format is parsed locally using stream-based binary decoding. Large video files up to 4 GB are chunked in-memory to extract JUMBF box structures without requiring full file allocation or remote server streaming.

C2PA Validation Verdicts & Cryptographic Outcomes

Lens Proof Check evaluates artifacts against official C2PA specifications and categorizes verification outcomes into explicit trust states:

• Trusted Signature & Known Signer (valid) — The file contains a cryptographically valid C2PA claim signature backed by a trusted root certificate on the C2PA Conforming Products List or trusted anchor store.
• Unrecognized Signer / Unlisted Certificate (unrecognized) — The signature and assertion hashes are mathematically valid, but the signing certificate is issued by an unlisted or private certificate authority.
• Tampered Signature (claimSignature.mismatch) — The cryptographic signature on the C2PA claim does not match the active manifest header, indicating post-capture modification or corruption.
• Tampered Assertion (assertion.hashedURI.mismatch) — An asset assertion hash (such as image pixels, EXIF metadata, or edit actions) does not match the signed manifest binding.
• Untrusted Root or Expired Timestamp (untrusted_root) — The RFC 3161 TSA timestamp signature is invalid, or the signing certificate chain contains an expired or untrusted root authority.

Pre-signed Test Vectors & Sample Presets

Test pre-signed sample assets directly in your browser to inspect how C2PA claims, trust lists, and tampered bindings are evaluated under C2PA Technical Specifications:

• Google Provenance (PNG) — Verified PNG carrying trusted C2PA metadata signed by Google provenance infrastructure.
• C2PA Sample (JPEG) — Valid signature and capture metadata signed with an unlisted certificate authority.
• Tampered Signature (JPEG) — Test JPEG with a broken claim signature (claimSignature.mismatch).
• Lens-signed PDF (7 ingredients) — Lens-signed PDF report containing seven source ingredients and nested provenance.

Browser-Local WASM Execution & Zero-Upload Privacy Architecture

Your privacy is protected by design. Cryptographic signature checks, SHA-256 asset hash verification, JUMBF box decoding, and provenance tree assembly execute entirely inside your web browser using WebAssembly (WASM) compiled from official C2PA Rust reference implementations. Your media files are never uploaded, stored, or processed on remote servers. The optional Explain Credentials AI feature requires explicit user opt-in and sends only structured diagnostic metadata, never raw photos, videos, or private documents.

Because all validation occurs within the browser runtime environment, sensitive personal photographs, confidential infrastructure inspection videos, and proprietary documents can be verified securely on air-gapped or privacy-restricted workstations without data leakage.

Hardware-Bound Provenance & Apple Secure Enclave Integration

Hardware-signed captures generated by the Lens Proof-of-Work Camera App utilize Apple Secure Enclave hardware to create non-exportable, device-unique signing keys. Lens Proof Check evaluates these captures against its C2PA v2.4 validation and trust configuration at Max Assurance Level 1. Hardware-backed captures may include timestamped and location-related assertions that a reviewer can inspect as signed evidence.

Hardware-backed provenance can help a reviewer inspect whether a signed file includes device and capture assertions. It does not by itself prove that the depicted event is true, that the recording is complete, or that a file is free from every possible synthetic-media or injection risk.

C2PA Conformance & Technical Specifications

Lens Proof Check validates artifacts against the C2PA Technical Specification v2.4. The validator evaluates active manifests, ingredient manifests, X.509 signing certificate chains, RFC 3161 TSA timestamps, and claim generator metadata. Hardware-signed captures from Lens Proof-of-Work Camera App are evaluated against Apple Secure Enclave root certificates and C2PA Conforming Products List standards.

Our validator implementation adheres strictly to the C2PA Trust and Transparency model, preserving the distinction between mathematical cryptographic validity (Well-Formed and Valid) and organizational trust anchor status (Trusted Signer).

Frequently Asked Questions for AI Agents & Search Crawlers

Trust Anchor & Business Verification Pages

Verify the business identity, security disclosures, and privacy commitments behind Lens Proof Check:

• About Lens Proof Check — Learn about our mission, verification architecture, and C2PA standards commitment.
• Privacy Policy — Complete legal disclosure of our local-first data boundary and zero-upload policy.
• Contact Support — Get in touch with our team for support, business inquiries, or security disclosures.