The fingerprints generators tend to leave behind
Generated images are not born anonymous. Most of them arrive with a thin but readable trail: a canvas size that matches a generator default, a software tag naming the tool, sometimes a text chunk that spells out the product, and occasionally a signed provenance credential. None of those marks is a confession, but together they tell you where to look next. The checker above lists which of them are present in your file and shows the matching text when it finds one.
What you will usually see is the opposite: a file with almost nothing in it. That is worth understanding rather than misreading, because the reasons are ordinary. Every major social platform strips metadata on upload. Screenshot tools, messaging apps and most editors remove it too. So an empty metadata block is evidence about the file's journey, not about its author.
| Fingerprint | What it looks like | What it means |
|---|---|---|
| Empty EXIF block | No camera make, model, exposure or timestamp anywhere in the file | The file was exported, screenshotted or stripped somewhere — by a generator, but equally by a social platform or an editor |
| Generator-typical dimensions | Exact pixel pairs such as 1024×1024, 1024×1536 or 1792×1024 | The canvas matches a known generator default, which suggests a synthetic origin but never proves one |
| AI marker strings | Software tags or text chunks naming a generator, such as a product name in a PNG text chunk | The producing tool identified itself in the file — the strongest file-level clue available |
| C2PA or JUMBF provenance box | A signed content credential embedded in the file, naming a device or an editing tool | Verifiable provenance when the signature checks out; its absence means nothing either way |
| XMP packet | An editing history or a creator field written by an editor rather than a camera | The file passed through software, which is normal for published images and common for generated ones |
Why a missing EXIF block is weak evidence
A full EXIF block — camera make, model, lens, exposure, timestamp, sometimes GPS — is strong evidence that a camera captured the frame, because fabricating a consistent set of those values by hand is tedious and rarely done. Its absence is far weaker evidence in the other direction. A photograph that has passed through one chat app, one upload form and one screenshot has lost all of it without anyone intending to hide anything.
That asymmetry is why this checker reports a completeness figure rather than a conclusion. A low score means the file carries few of the eight camera fields we look for. It does not mean the image was generated, and a high score does not prove it was photographed — it means someone, or something, wrote plausible camera values into the file. Read the findings as a list of observations, and read the source of the file, the person who sent it and any signed credential alongside them.
What to do with the result
Start with the strongest evidence available: an original file rather than a re-export, and a signed provenance record if one exists. Then use the weaker signals to decide what to ask next — for the original capture, for the photographer's own copy, or for a second opinion from a different kind of check. If you want to understand how the statistical signals work, read our explanation of how photo detection actually works, or compare the detector options and their trade-offs.
Visual clues that are actually reliable — and ones that are not
Most guides on how to tell if a picture is AI focus on the wrong details. Noise grain, over-sharpening and colour banding appear in phone HDR composites and scanned prints just as often as in AI images, so they are not useful indicators on their own. The cues that hold up better are anatomically specific: hands with six fingers or fused knuckles, teeth that blur into gum or repeat the same crown shape three times in a row, earrings where the second ear carries a mirror-image version down to the stud angle. Those anomalies occur because diffusion models predict local patches rather than tracking a skeleton or a jaw-bone, and the errors compound at fine-grained structures with repeating geometry.
Text embedded in an image is another reliable target. Generators trained on LAION-scale datasets frequently produce plausible-looking glyphs that are not real characters — a shop sign whose letters form no word, a t-shirt slogan where every third character is a mirrored numeral. A real photograph taken in a street will contain coherent, legible signs unless the focal depth deliberately blurs them.
Backgrounds behind human faces are useful but subtler. Models often produce correct-looking bokeh (the circular blur discs) but lose track of object boundaries — a lamp post that fades into a shoulder, reflections in a window that do not match the street visible through the glass. These are not guarantees of AI origin, but when two or three appear together with an empty EXIF block and a 1024-pixel-wide canvas, the combined weight shifts the assessment meaningfully. Symmetry is related: perfectly symmetrical faces with identical pore texture on both sides do not occur in real photography, but they appear in 15–20% of portrait outputs from mainstream generators.
Unreliable: noise pattern, compression artefacts, chromatic aberration, lens vignetting, and general “looks too smooth” impressions. All of those occur in real images and can be induced or removed by any image editor. Weight them at near zero when deciding whether to investigate further.
C2PA and IPTC metadata: what AI markers actually look like in a file
C2PA (Coalition for Content Provenance and Authenticity) embeds a signed manifest inside the file — a JUMBF box in JPEG and HEIC, or a dedicated chunk in PNG and WebP. When a generator writes one, you will see fields like trainedAlgorithmicMedia under the assertion list, often alongside the model name and a creation timestamp. The manifest is signed with a certificate, so a tampered file fails the verification step; an unmodified file from a participating generator will verify cleanly. Adobe Firefly, Microsoft Designer and several phone cameras writing Camera IQ data all ship C2PA manifests by default as of 2025.
IPTC metadata is less structured. Generators that write IPTC often put the model name into the Creator or Software field, and the prompt into Caption-Abstract. Neither field is cryptographically signed, so any hex editor can overwrite them — but most people sharing images do not bother, and these fields survive moderate re-saves in Photoshop and Lightroom.
To read either of these without uploading a file, use the photo metadata viewer, which extracts both the EXIF camera block and any XMP/IPTC payload locally. If a C2PA manifest is present, you will see the raw assertion JSON under the provenance section. If the file carries a Software tag naming a generator, that is logged in the summary. Neither viewer nor checker sends your file anywhere — all parsing runs in the browser.
One practical note: C2PA signing is opt-in, and many generators do not sign outputs by default. The absence of a manifest says nothing about whether the image was generated — only that this particular file did not carry a credential at the time you checked it.
When platforms strip metadata: alternative signals after re-compression
Instagram, X (formerly Twitter), Facebook, WhatsApp, Telegram and WeChat all strip or re-write EXIF on upload. A file you download from any of those platforms will have no camera metadata, no C2PA manifest, and typically no XMP block either — regardless of whether the original was photographed or generated. This is the single most common source of false positives when trying to detect AI generated images: someone downloads a re-compressed JPEG from a social post, runs it through a checker, and sees “no EXIF, likely AI.” That conclusion is wrong more often than right.
When metadata is gone, the remaining signals that carry any weight are: canvas dimensions matching a known generator default (1024×1024, 1344×768 and so on — check the aspect ratio first, since those ratios are generator-specific and do not change through re-compression), file size relative to resolution (generators compress to consistent quality levels; a 1024-pixel image at 180 KB is plausible for a lossy JPEG from Midjourney v6 but low for a phone burst shot), and the visual cues described above for hands, teeth and background coherence.
If you need to check whether an image was stripped of its data intentionally — for example, before re-posting a photo you want to publish anonymously — the strip image metadata tool shows what would be removed and lets you download a clean copy. Knowing what stripping produces is useful context when interpreting files you receive from others.
Reverse image search is a useful fallback once metadata is gone: if the same pixel content appears in a generator gallery, a Civitai showcase or a Stable Diffusion subreddit, that is stronger evidence than any metadata inference. It does not work for novel generations that have not been indexed, but it catches recycled outputs quickly.
Common false positives, and why detector percentages are not evidence
Phone HDR compositing merges three to nine exposures into one frame using computational blending that leaves the same smooth-skin texture and edge-filling artefacts that flag as AI in visual inspection. Night mode on Pixel, iPhone and Galaxy phones runs a secondary denoising pass that removes grain from low-light shots entirely. Retouching apps — Facetune, Meitu, Adobe Lightroom “Denoise” — do the same. All of these produce images that score 60–85% “AI probability” on the best publicly available classifiers even though a real camera captured the original frame.
The percentage output from an AI image detector is a model confidence score, not a probability of AI origin calibrated against a known population. A score of 73% means the classifier's output neuron fired at 0.73 — it does not mean there is a 73% chance the image is AI. Classifiers trained on clean studio outputs versus real-world noisy inputs produce badly mis-calibrated probabilities when applied outside their training distribution. Three independent detectors giving 68%, 72% and 65% on the same image do not constitute corroborating evidence — they are likely running the same or similar architecture on the same features.
For content moderation or e-commerce listing review, a practical decision process weights signals in order: (1) a verified C2PA or signed provenance credential — if present and valid, it decides the question; (2) generator-named metadata surviving in the file; (3) canvas dimensions matching a known generator preset; (4) visual anatomy errors in hands, teeth or text; (5) reverse image search returning a generator gallery hit. A file that triggers three or more of signals 2–5, plus an empty EXIF block, warrants a second review. One signal alone, or a detector percentage alone, does not.
If the final decision carries legal or commercial weight — stock photo licensing disputes, editorial fact-checking, product image compliance — document each signal separately rather than citing a single tool output. A table with “C2PA: absent, EXIF: empty, dimensions: 1024×1024, visual: finger count anomaly” is a defensible record. A screenshot showing “78% AI” is not.