Upload the file to contentcredentials.org/verify. It is the Content Authenticity Initiative's public inspection tool, it runs in a browser, it is free, and it is the only step here that can end the question outright. Most files come back with nothing, which is the honest outcome rather than a disappointing one.
That gap — one check that can settle a file, four that can only narrow it — is why the order matters more than the checks themselves. Each section says what the step cannot tell you as well as what it can, because a check whose failure mode you do not know is worse than no check. And one thing runs through all five: none of them proves a person made the picture.
What is the one check that can actually settle it?
A Content Credential can end the question in either direction, and nothing else here can. It is a record of how the file was made, carried inside the file, signed by whoever made it, and cryptographically tied to the exact bytes in front of you.
The standard behind it is C2PA, the Coalition for Content Provenance and Authenticity, which publishes an open specification; Content Credentials is the consumer-facing name for the same thing. The record is called a manifest, and it holds assertions — structured statements about how the content was made. One assertion is a list of actions, and an action can carry a `digitalSourceType`, a term from IPTC's published vocabulary naming the process that produced the content. `trainedAlgorithmicMedia` means a generative model; `digitalCapture` means a camera sensor, and so does `computationalCapture`, which is what a modern phone writes for multi-frame HDR and night modes; `compositeWithTrainedAlgorithmicMedia` is IPTC's term for "augmentation, correction or enhancement using a Generative AI model, such as with inpainting or outpainting operations" — which our engine reads as `edited` rather than outright synthetic.
Two further pieces make the manifest worth anything. The first is a hard binding: a hash of the file's actual bytes, stored inside the manifest. Change one byte and it stops matching. The second is the signature, made by a certificate that either does or does not chain back to a list of signers somebody is willing to vouch for. When the signer is one Verify recognises, it displays the name of the certificate owner and the time of the claim signature. If you would rather not upload anything, the CAI also publishes `c2patool`, a local command-line utility, and SDKs in several languages.
Now the limits.
Absence is the common case, not a finding. The manifest lives in the file's container, and a tool that rewrites the container without carrying it forward drops it — we removed one with an ffmpeg stream copy that did not alter a single pixel. In our image lane, a clean result from this rung means only "no manifest in these bytes".
A signature is not automatically an answer. Our corpus holds a clip from the C2PA public test files that verifies perfectly against its own bytes and names a hardware-attested capture SDK, and still returns `uncertain`: its active manifest carries no actions and no `digitalSourceType`. A signature over a file that never says how the content was made is not provenance of a capture.
Which manifest you are reading also decides everything. A store holds the active manifest, whose hard binding covers the bytes under analysis, plus one for every ingredient composited or edited in — so an AI-generated image with a real photograph pasted into it carries a perfectly genuine capture assertion belonging to the photograph. Only the active manifest speaks about the file you have.
And even a trusted capture manifest is not proof the scene was real. A camera can photograph a screen. Our policy file puts a proof-tier human finding at 3 out of 100 rather than 0 for exactly that reason, and gives it an interval half-width of 2 rather than 0 because a signature proves the signer signed the claim, never that the claim is true.
Is the EXIF metadata worth reading?
Read it, but only to learn what last wrote the file. EXIF is unsigned text: any editor can write it, any uploader can strip it, and none of it is bound to the pixels.
We know how badly this goes because we shipped it. An earlier version of our image engine kept a list called `_AI_SOFTWARE_MARKERS` and substring-matched the EXIF `Software` tag against tokens including `gpt` and `dream`; any hit forced the score to at least 90 at "Very High" confidence. `gpt` is a substring of ordinary strings, and "Dream" ships in consumer camera firmware. It was a false-positive generator wearing a high-confidence label, and it is gone.
The same trap is open to a person reading the tag by hand. A `Software` field saying "Midjourney" is a string somebody could have typed, and so is one saying "iPhone 15 Pro" — copying a tag is far easier than making a convincing image. The absence of camera EXIF is weaker still: any uploader can strip it, so "no camera data" describes the last tool that touched the file, not the origin.
Encoder-level structure — JPEG quantisation tables, marker order — is sturdier, being a property of the bytes rather than a field somebody filled in, but it answers a different question. Our forensics lane attaches the same caution to every such observation: the JPEG marker order "identifies the last encoder, never the author, and any re-save replaces it", and the quantisation table "identifies the LAST encoder in the pipeline, not the origin of the picture and not whether it is synthetic".
Does a reverse image search show where a picture came from?
No. It finds other copies of the picture, which is a different question, and the difference is the whole point. Google Lens, TinEye and Yandex each surface pages carrying the same or a similar image.
What it can genuinely establish is age. An earlier appearance is a lower bound: if the picture sits in a 2014 news archive, no 2026 generator made it. Dating is the one thing here that can be decisive without any cryptography, and it is the same logic our own measurements rest on — every one of the 496 documents in our human text corpus was written before 2022, on the grounds that a "human" corpus quietly containing AI writing yields a reassuring number that is wrong.
What it cannot establish is anything at all from a miss. Zero results is exactly what a freshly generated image looks like and exactly what a freshly taken photograph looks like. The earliest copy you find is the earliest copy some index knows about, which is not the same fact as first existence.
Can you tell by looking at the pixels?
Usually not, and the tells most people trust have the least evidence behind them. Nightingale and Farid, writing in PNAS in 2022, showed synthetic and real faces one at a time to 315 participants: mean accuracy was 48.2%, against chance of 50%. A second group of 219 people was trained on specific rendering artefacts and given trial-by-trial feedback, which lifted average accuracy to 59.0%.
Read that in both directions. The faces came from StyleGAN2 in a study published in 2022 — one narrow category, from an architecture no longer at the front. That cuts against the study as a description of 2026, and cuts the same way against the artefacts its training taught.
Which is the problem with hands and garbled text. They are the two tells everybody knows, which makes them the two under the most pressure to fix. We have no measurement of how often they survive in current output and will not offer one. What we can say is what their absence is worth: nothing. A picture with well-formed hands is a picture with well-formed hands.
If you are going to look, look at physics rather than style — shadow directions that disagree, reflections that do not match what stands in front of the mirror, perspective lines that cannot meet. Farid proposed exactly this class of analysis in two 2022 preprints; the lighting one gives its grounds as paint-by-text synthesis being "not based on explicit geometric or physical models" and the human visual system's "general insensitivity to lighting inconsistencies". That is his motivation, which we have read; his results were measured against DALL·E 2 four years ago and we are not extrapolating them. The reasoning survives the model, though: the inconsistencies worth checking are the ones your eye slides past.
Treat any visual tell as a hypothesis that sends you back to the Content Credentials check, never as a conclusion. Its failure mode is the worst here: being certain feels identical to being right, and leaves no record anyone can re-check.
What is an AI image detector worth, including ours?
It is the weakest instrument here, and in our product that is policy rather than taste. Our image lane runs five ranked rungs and the strongest one that fires decides alone — no blending, because a signature check and a pixel-statistics estimate share no probability space anyone has measured.
The learned classifier is rung five, the bottom. Its tier is fixed at `weak` permanently: a learned estimate over pixels cannot outrank a signature or a recovered payload, and no model swap promotes it. A weak-tier verdict reports an interval half-width of 22 points out of 100, wide enough that it visibly refuses to look like a strong one. The model is Community Forensics ViT-S/16-384 (Park and Owens, CVPR 2025), and its firing threshold of 0.50 is the reference evaluation's operating point carried over unchanged — annotated in our code as `THRESHOLD_SOURCE = "declared-default"`, never fitted to our data. No public accuracy claim may be made until a threshold is chosen on our own held-out corpus, so we publish none.
Our measured image result, in full — the lane's, not this rung's alone: five of five Stable Diffusion outputs came back as AI, and none of three photographs from Wikimedia Commons was wrongly accused. Eight files, one generator on the AI side. It shows the path works on real bytes; it is not a coverage rate, and another generator could score differently. Note what the three photographs did not get. They were not accused, and they were not cleared either — that verdict needs a signed capture manifest, which no classifier can produce.
The structural limit is the part a better model does not fix. A low synthetic score is the expected output for a laundered AI image: screenshot it, re-encode it, and the pixel statistics the model reads are largely gone. "The classifier scored low" is equally consistent with a camera photo and with an AI image that went through a social feed, and nothing in the score separates them. The direction this rung may report is synthetic or inconclusive, never human, enforced by the type on its finding and re-checked in the function that builds it. Worth asking of any detector you use: what does it do with a low score, and does it call that outcome human?
What can you say when every check comes back empty?
That is the ordinary result, and it has an honest reading that is not "probably real". Our image lane prints the same line verbatim whenever no manifest is recovered, for exactly this moment:
> "No C2PA manifest was recovered from this file. That is not evidence of human authorship."
What you have after five empty checks is a list, not a verdict: the file carries no Content Credentials; its metadata names whatever wrote it last and nothing about who made the picture; the earliest copy any index knows of is such-and-such a date; nothing in the shadows or perspective contradicts the scene; a classifier scored it low, which is also what a laundered AI image scores. Less satisfying than an answer, and it is what you actually hold. It is also defensible, which an answer would not be, and if somebody is going to act on your conclusion, defensible is the property that matters.
If you want it settled rather than narrowed, the only lever that exists points upstream. Ask the person who made the image for the original file, before whatever platform stripped its manifest. That request either produces bytes with a signature over them or it does not, and either outcome tells you more than any amount of counting fingers.
