AI Image Inspector — Cross-Vendor Provenance Diagnostic
AI image detector and image-provenance diagnostic. Reads C2PA Content Credentials, SynthID, dwtDct watermarks, PNG text chunks, EXIF Software tag, and XMP CreatorTool — all in your browser, no upload.
Drop a PNG, JPEG, or WebP image
AI generation fingerprints are detected in your browser. Nothing is uploaded.
Intended use
- Intended for personal privacy awareness: inspecting metadata in files you own to understand what information is embedded. Does not modify or remove content.
- The inspector reports fingerprints it finds in the file. It does not prove the image is real when no fingerprints are present — a fully-stripped AI image will also return 'No AI generation traces found.'
- Heuristic detectors (SynthID, dwtDct) can produce false positives on heavily-compressed or noise-injected images. Treat the probability score as a clue, not a verdict.
Every modern image generator — OpenAI’s DALL-E 3, ChatGPT, and GPT-4o; Adobe’s Firefly and Photoshop; Google’s Gemini and Imagen; Microsoft’s Designer and Bing Image Creator; Stability AI’s Stable Diffusion WebUI, ComfyUI, and SDXL; NovelAI; Black Forest Labs’ Flux; Midjourney; Ideogram; Recraft — leaves fingerprints on the files it produces. The fingerprints are not the visible pixels; they are the metadata, the side-channel chunks, the frequency-domain signatures, and the watermarks that ride alongside the pixel data. Some are visible to any EXIF reader. Some are visible only to a hex editor. Some are invisible at the pixel level and require a frequency-domain analysis to detect. No single detector catches every generator, and no generator leaves a single, universal fingerprint.
This inspector runs six independent detectors in parallel and aggregates the result into one report. The C2PA detector reads the cryptographic Content Credentials manifest that OpenAI, Adobe, Google, and Microsoft embed at generation time. The SynthID detector scans the frequency domain for Google’s invisible image watermarks. The dwtDct detector looks for the research-grade DWT-DCT watermark that some academic models apply. The PNG metadata detector finds Stable Diffusion WebUI’s parameters chunk and ComfyUI’s workflow chunk. The EXIF detector reads the Software tag for a generation tool self-identification. The XMP detector reads the CreatorTool field for the same purpose. Each detector produces a probability score, byte-level evidence, and a link to the matching cleanup tool.
The result is the most complete single-image provenance diagnostic that runs in a browser, with no upload, no ML inference, and no third-party calls. The file never leaves your device.
How to use
Drop a PNG, JPEG, or WebP image
Drag any image into the drop zone. The file is read as a Uint8Array in your browser and never leaves your device. The inspector runs every detector in parallel and aggregates the results into a single report.
Read the fingerprint report
Each detector that produced a non-zero score shows as a card: a label, a 10-bar probability meter, the byte-level evidence, and a direct link to the matching cleanup tool. Cards are sorted highest-probability first. A clean image shows the verdict 'No AI generation traces found.'
Clean and verify
Each detected fingerprint links to its dedicated cleanup tool. Run the cleanup, drop the cleaned file back into the inspector, and confirm that the matching card has dropped below the detection threshold.
Frequently asked
Is this an AI image detector?
It is a structural and metadata-based detector — not a neural network. The inspector looks for known AI generation artifacts (C2PA JUMBF payloads, SynthID frequency-domain signatures, Stable Diffusion ComfyUI text chunks, Stable Diffusion WebUI 'parameters' chunks, dwtDct watermarks, and generation software self-identifying in EXIF or XMP) and reports each one with byte-level evidence. It cannot catch a fully re-encoded image whose metadata was scrubbed and whose pixel-level watermark was removed, but for any image that still carries any of the seven fingerprints, the answer is yes.
What vendors does it detect?
The detector recognizes fingerprints left by OpenAI (DALL-E 3, ChatGPT images, GPT-4o), Adobe (Firefly, Photoshop generative fill), Google (Gemini, Imagen), Microsoft (Designer, Bing Image Creator), Stability AI (Stable Diffusion WebUI, ComfyUI), NovelAI, Black Forest Labs (Flux), Midjourney, Ideogram, and Recraft. Each fingerprint links to a vendor-specific cleanup tool. An image with no detectable fingerprints is reported as 'No AI generation traces found.'
Why check six different fingerprints?
No single AI generator leaves a single, universal watermark. OpenAI, Adobe, and Google signed onto C2PA in 2024, but most open-source generators (Stable Diffusion, NovelAI, Flux) do not. Stable Diffusion WebUI embeds a 'parameters' PNG text chunk with the prompt and seed; ComfyUI embeds a 'workflow' text chunk. SynthID is Google's invisible frequency-domain signature for Imagen outputs. dwtDct is a research-grade watermark that some academic models apply. Inspecting all six at once gives a complete answer in one pass.
What does the verdict mean?
The verdict is the aggregate answer. 'No AI generation traces found' means none of the six detectors produced a non-zero score. 'Some weak signals detected' means at least one detector produced a low score — inconclusive, often a false positive on heavily-edited images. 'Likely generated by a single AI vendor' means one detector produced a high score (above 0.5). 'Multiple high-confidence fingerprints from different vendors' means at least two detectors scored above 0.5 — usually indicates compositing or a re-encoded image with stale metadata.
Are my images uploaded?
No. The image bytes are read into a Uint8Array in your browser. All six detectors run as pure functions in JavaScript — no network call, no server roundtrip, no third-party API, no telemetry. The file never leaves your device, and nothing is stored between sessions.
Why is it called an 'inspector' and not a 'detector'?
Detection is one of the things the inspector does. Inspection is the broader job: it tells you what is in the file, who made it, what tool produced it, and what cleanup is available. The inspector is the diagnostic panel that runs before any cleaning.
Limitations
- Structural detection onlyThe inspector reads metadata, chunks, frequency-domain signatures, and known watermarks. It does not run a neural classifier on the pixel content. An image that was generated by an AI and then re-encoded with all metadata stripped and no watermark survives in its pixel content will be reported as 'No AI generation traces found.' The inspector catches any image that still carries at least one of the six fingerprints — it cannot catch a fully-cleaned AI image that has been processed by a re-encoder.
- PNG, JPEG, and WebP onlyThe C2PA chunk reader works on PNG iTXt/zTXt and JPEG APP11 JUMBF. SynthID and dwtDct operate on the decoded pixel data, which is loaded for PNG, JPEG, and WebP. EXIF and XMP are read from JPEG APP1, PNG iTXt, and WebP 'EXIF'/'XMP ' chunks. AVIF, HEIC, and TIFF use different containers and are not decoded.
- SynthID and dwtDct are heuristicBoth are reported as heuristic because the exact watermark is not publicly specified. The detector uses published analyses of the frequency-domain signature and statistical models to estimate the probability that the watermark is present. False positives are possible on heavily-compressed or noise-injected images. A 'heuristic' label on the card is the inspector's way of saying 'treat this as a clue, not a verdict.'
- Vendor attribution requires a matching fingerprintIf the C2PA manifest is the only high-confidence fingerprint, the vendor is named (OpenAI, Adobe, Google, Microsoft). If only EXIF or XMP carries the generator's name, the vendor is named from the field value. If only SynthID or dwtDct is positive, the vendor is reported as 'SynthID (heuristic)' or 'dwtDct signature' without naming the underlying model.
Platform notes
- macOS
- Preview.app and Quick Look do not surface C2PA, SynthID, dwtDct, or any of the detector fingerprints. The inspector is the right tool for diagnosing the provenance of an image dropped from Slack, a screenshot from a chat, or a downloaded stock photo. To inspect a specific tag, right-click → Get Info → More Info shows EXIF but not C2PA, XMP, or watermarks.
- Windows
- Windows Photos and File Explorer show EXIF and basic XMP, but not C2PA, SynthID, or dwtDct. Right-click → Properties → Details shows Make, Model, DateTime, and Software tags. For full provenance, drop the file into the inspector — the report covers every fingerprint in one pass.
- Linux
- CLI alternative for some fingerprints: `exiftool -api RequestAll=3 image.png` shows C2PA claim chains and XMP, but does not detect SynthID or dwtDct. The inspector is the right pick for a full diagnostic when libexiftool is missing C2PA support or when the SynthID/dwtDct detectors are needed.
- Web
- Runs entirely client-side. The image is read as a Uint8Array, all six detectors run as pure functions, and the report is rendered as HTML. No upload, no server roundtrip, no telemetry, no third-party calls. The file never leaves your device.