C2PA Content Credentials · Offline verifier
Verify the signature.
Verify the identity.
Verify the watermark.
Drag a file in. provcheck checks three orthogonal signals: the C2PA cryptographic signature, an atproto identity attestation binding the signer to a public handle, and a neural watermark embedded in the media itself. One receipt, fully offline.
No account.·No upload.·No telemetry.
provcheck verifies the C2PA signature, cross-checks an atproto identity attestation, and runs neural-watermark detection across audio, image, video, and text. The current detector families, supported formats, and per-release notes live in the repository. Release notes →
Two personas
Verify what you receive. Sign what you create.
For people who receive content
Drop a file in and read the receipt: signature, identity attestation, watermark. No account, no upload, no telemetry.
For people who produce content
provcheck-kit signs your renders, binds your atproto identity to the signature, and publishes the receipt. Five-minute setup, one flag per render.
How it works
Three steps. No learning curve.
Step 01
Drop the file in
Drag any audio, image, or video onto the window, or pass it on the command line. No format conversion, no pre-processing.
Step 02
See the verdict
Verified (green) means the signature is cryptographically intact. Unsigned (amber) means there is no claim to verify. Not verified (red) means the file was tampered or malformed.
Step 03
Read the receipt
Signer identity. Signing time. Tool that produced it. AI model used, if any. Full edit chain. All custom claims: training provenance, creator identity, licence, EU AI Act statements.
Why this matters
Provenance exists. The tooling to check it does not.
C2PA is the open standard that lets creators attach cryptographically-signed provenance to files. Adobe, Microsoft, BBC, Leica, Nikon, and Sony camera lines already produce C2PA-signed content. AI tools are starting to as well.
Adobe's c2patool is a developer-oriented CLI. The main web verifier requires uploading your file to a server, unacceptable for sensitive content. There is no polished cross-platform desktop app anyone can recommend to a non-technical recipient. provcheck fills that gap. It works on any C2PA-signed content from any vendor: Photoshop exports, Leica captures, rAIdio.bot outputs, anything the standard covers.
What you get
One utility. Every signed format.
Fully offline
Files never touch a network. No account, no upload, no server. Run it air-gapped.
Any signed file, any vendor
Verifies C2PA content from Adobe, Leica, Nikon, Sony, the BBC, AI tools, anything that follows the standard. Neural-watermark detectors run side-by-side across audio, image, video, and text; the current detector list is in the repo.
Three states, plain language
Verified, Unsigned, or Not verified. Every failure mode has a human-readable reason, no cryptographer required.
Humans and pipelines
Desktop app for drag-and-drop. Matching CLI with JSON output for CI. Same core library drives both.
Apache-2.0, auditable
All source on GitHub. Fork it, audit it, reproduce the build. No telemetry, no binary blobs.
What we verified, not what we hid
provcheck reports the signer's identity from the certificate. Trust-list policy is yours to decide, the tool tells you the cryptographic truth.
Yubikey-backed identity
Mint your signing key on a Yubikey PIV slot. The private key never leaves the device, every signature gates on the PIV PIN. The OS keychain and age-encrypted file backends are still supported as defaults.
Who it's for
Anyone who needs to know what a file is before they publish it.
- Journalists & fact-checkersVerify attribution on AI-generated or camera-sourced media before it ships.
- Archives & preservation institutionsDiscriminate signed from unsigned material at ingest. Infrastructure for long-term provenance.
- Platform trust & safety teamsEvaluate tooling-level provenance signals for the ingest pipeline.
- CreatorsConfirm your signed outputs survived the round-trip through export, conversion, upload, re-download.
- DevelopersIntegrate C2PA verification into pipelines via the JSON-output CLI mode.
- Everyone elseIf someone sends you a file with a receipt, you can now read it.
At ingest scale
Production pipelines, not a desktop utility.
The downloads on this site are the free consumer tool: one file at a time, on your own machine. If you run ingest at archive, platform, or publisher scale and need C2PA validation wired into your pipeline (batch throughput, queue integration, custom trust policy, audit logging, operational support), we design and run that too, as a commercial engagement.
Serious inquiries: [email protected].
Get it
Free. Open source. Works offline.
Windows 10+, macOS 12+ (Apple Silicon, aarch64), Linux x86_64. Apache-2.0. Single-binary install, no runtime dependencies.