Is this photo trustworthy?
Every photo has a story. JPEG Trust brings together information about its origin, history and content to help you assess its trustworthiness in the context that matters to you.
Mostly trustworthy · 12 of 13 checks passed
A valid signature isn't enough. You need to know: should I trust this image?
Most tools just check whether a signature is mathematically correct. JPEG Trust goes further: you define what "trusted" means for your context, and the tool checks the image against that standard.
A capture device can sign an image when it is taken.
A capture device or app can sign a Trust Manifest into the image at capture. It can record the creation action, the time and a hash of the pixels.
when: "2026-03-14T09:42:11Z"
digitalSourceType: ".../digitalCapture"
Every edit is recorded — nothing is hidden.
Crops, colour corrections, AI fills and redactions can each be recorded as an action: what was done, when, and with which tool.
softwareAgent: { name: "image editor" }
when: "2026-03-14T10:05:00Z"
Check the image against your own standards.
You decide in a Trust Profile what makes an image trustworthy for your context. A newsroom might require author identity, an edit history and an AI declaration. The tool checks each requirement and gives a clear verdict.
verdict: "mostly_trusted"
score: 0.9231 · passed_checks: 12 · total_checks: 13
Open formats. Works with existing tools.
Built on JPEG Trust Part 1, second edition. Trust Profiles are plain YAML files that you can keep under version control.
profile: "newsroom_profile.yml"
# JPEG Trust Part 1 Second Edition
Read, sign, verify. Three things, one tool.
The record of who made a photo and what happened to it lives inside the file itself. It survives copies, exports, and re-uploads.
Read
Drop in an image and see what its Trust Record says: who made it, when, any recorded edits, and any declared AI use.
assertion: "jpt.rights"
digitalSourceType: ".../digitalCapture"
Sign
Add your name, copyright, edit history, and AI declarations. After signing, the tool re-reads the file to confirm everything was written correctly.
signature: "COSE_Sign1"
read_back: "Manifest readable"
Verify
Pick a Trust Profile, run the image against it, and get a report: what passed, what's missing, and whether to trust the result.
passed_checks: 12 · total_checks: 13
score: 0.9231
Six tools for checking, signing, and verifying photos.
Each tool can also be used from a script or an API — anything you do in the browser can be automated on a server.
Read Manifest
Drop a photo. See who made it, when, what was edited, and whether AI was involved.
Open Read →Add Manifest
Sign your own photos with your name, copyright, edit history, and AI declarations.
Open Add →Verify trust
Check an image against a Trust Profile. Get a clear verdict with a downloadable report.
Open Verify →Create trust profile
Define what "trusted" means for your use case. Start from a template or build your own.
Open profile builder →Batch verify
Upload a folder, pick a Trust Profile, and get a table showing pass/warn/fail per image.
Open Batch →Examples & API
Test files covering every verdict. Use them to learn the tool or test your own integration.
Browse examples →Verify, embed, validate — from any backend.
The same engine that powers the in-browser tools is available as a Python library and an HTTP API.
# Verify an image against a trust profile import json from jpegtrust import verify_image report = verify_image("photo.jpg", "profile.yaml") print(report.verdict) # mostly_trusted print(report.score) # 0.9231 print(report.passed_checks, report.total_checks) # 12 13 # Write the JSON report to disk with open("report.json", "w") as f: json.dump(report.to_dict(), f, indent=2)
For the people who care whether an image is real.
JPEG Trust is intentionally narrow. It does one thing — make image provenance verifiable.
Verify wire photos before they reach the front page.
Run JPEG Trust on every submission from stringers and freelancers. Manipulated images get caught at the photo desk, not after publication.
Show how your work was made, without sharing the raw file.
Sign at export. Anyone can then check who signed the image and what it records, without you handing over the original.
JPEG Trust enables Article 50 AI labelling.
The EU AI Act requires AI-generated content to carry machine-readable provenance metadata. JPEG Trust enables mechanisms to embed what Article 50 demands.
How to comply with Article 50 →Frequently asked.
Short answers, here. Longer versions live in the docs.
Is JPEG Trust the same as C2PA?+
JPEG Trust is a large trust framework that covers provenance, authenticity and integrity, along with intellectual property rights. It supports generating reports that check media assets against a given context (trust profiles). Parts of the framework, largely those on provenance, are built on the C2PA manifest and are therefore compatible with C2PA.
What if the image has no manifest?+
JPEG Trust will report "unsigned" — which is not the same as "fake". It just means provenance cannot be verified. Treat unsigned images as you always have.
Does the manifest survive crops, resizes, and platform reposts?+
If the tool you use preserves the manifest, yes — mainstream editors do, and the signature accommodates declared edits without breaking. Some social platforms still strip metadata.
Do my images get uploaded to a server?+
Images can be processed locally by the Python module, or by a small verification API you host yourself. For production, run your own instance.
Can someone fake a manifest?+
Anyone can sign anything. A manifest is only trusted if its signing certificate chains back to an issuer on the ISO trust list. Files signed with unrecognized keys raise an "unknown issuer" warning, not a green verdict.
Open, ratified, citable.
Every part of JPEG Trust is published as an international standard. Implement it however you like.
Profile-based trust for any media asset.
Read, embed, verify. Browser tools or a small Python API. Open formats, no lock-in.
Supported by
This implementation is supported by the UK Engineering and Physical Sciences Research Council (EPSRC) through an Impact Acceleration Account held at Newcastle University. We acknowledge JPEG Trust colleagues for their valuable feedback.
