File provenance inspector

A label under an image is a claim by whoever wrote the page. The file itself carries its own: a C2PA manifest in a JUMBF box, an EXIF block with Software and Make tags, an XMP packet naming the encoder. Reading those is the only way to know whether an asset still has provenance or had it stripped in a screenshot.

Dropping a file here parses its own bytes. JPEG markers are walked one by one, PNG chunks are enumerated by type and length, and the readable metadata region is scanned for known generator strings. The result is a list of what is actually present.

Most consumer exports have no C2PA at all, and that is not proof of anything: plenty of cameras and every screenshot remove it. What matters is the combination. A file that claims to be a photograph, carries no EXIF, and contains the string ComfyUI in its metadata is telling you two different things.

The scan reads the first two megabytes of metadata region, which covers the headers these formats use. A generator string buried in a compressed payload will not be found, and the tool says so rather than implying a clean bill.