01
Metadata is evidence, not a verdict
EXIF, XMP, PNG text chunks, software tags, and workflow records can reveal useful facts. They can also be removed or rewritten, so no single field should be treated as absolute proof.
Inspect embedded fields ↗OriginFlux
Local processingOpen lab
The creator evidence field guideRead the signal.
Read the signal.
Respect the limit.
Practical guidance for documenting digital files without turning uncertain evidence into a false claim.
02
Clean a copy—never your only original
Privacy cleaning re-encodes visible pixels into a new container. Keep your source file because embedded creator, camera, and workflow evidence may be useful later.
Create a clean copy ↗03
A fingerprint identifies exact bytes
SHA-256 is excellent for checking whether two files are exactly identical. It does not identify the creator, prove ownership, or explain why a file changed.
Generate a fingerprint ↗04
Credential detection is not verification
A browser scan can surface C2PA or JUMBF-related data. Cryptographic validation and claim inspection belong in a standards-based verifier.
Check credential signals ↗05
Declarations should stay labeled
A creator manifest is most credible when detected facts, user declarations, missing information, and limitations remain visibly separate.
Build a manifest ↗06
Delivery records should be reproducible
Record the exact file name, dimensions, format, byte size, and fingerprint at handoff. A recipient can hash their copy later and compare it with the delivery record.
Run a delivery check ↗Standards-based handoff
Open official verifier ↗When a credential signal appears, verify it at the source.
OriginFlux detects recognizable credential-related data locally but does not claim to validate cryptographic signatures. The official Content Credentials verifier is the appropriate next step.