The honest answer has two halves. When metadata says a picture came from an image generator, that is useful evidence, and some of it is hard to fake. When metadata says nothing, you have learned almost nothing, because the labels are optional and fall off easily. Metadata can confirm "AI-made" now and then; it can almost never confirm "real".
This page explains the three kinds of labels you might find, how to read them, and where each one stops being reliable. To look inside a file yourself, the free photo metadata checker shows its hidden fields in plain English, in your browser, without uploading the image.
Three labels a photo might carry
| Label | What it is | How much to trust it |
|---|---|---|
| C2PA Content Credentials | A signed record of where the file came from and how it was edited | Strong when present and valid; often absent |
| IPTC "Digital Source Type" | A standard metadata field with values such as "Created using Generative AI" | Useful hint; anyone can write or delete it |
| Software and description fields | Text such as a generator's name in the EXIF or XMP data | Weakest; easy to add, change or remove |
Content Credentials (C2PA)
The Coalition for Content Provenance and Authenticity (C2PA) publishes an open standard called Content Credentials. Its FAQ describes them as a cryptographically secure way to record how content was created, what tools were used, when and where, and how it changed. Each credential is digitally signed, and it includes hashes of both the image and the provenance data, so any change to either one breaks the link and signals tampering.
The Content Credentials site says the project is a collaboration of hundreds of companies, naming among them Microsoft, Adobe, Google, Meta, OpenAI and Amazon. That matters because some image generators and editing tools write Content Credentials into what they produce. If a file carries a valid credential that says it was generated, that is about as clear a signal as metadata gets.
The limits, in the C2PA's own words:
- Removal is easy. The FAQ says manifests "can be separated" from the file, accidentally or on purpose. To cope, the C2PA supports watermarks and fingerprints that can help find the credential again; the Content Credentials site calls this making them durable.
- Provenance can be incomplete. The explainer gives the example of a crop in a tool that does not support Content Credentials: the record is not updated.
- It is not a truth label. The explainer says provenance alone cannot tell you whether content is true, accurate or factual.
- No label is not a red flag on its own. Asked whether to distrust media without credentials, the explainer answers "Maybe", and says no assumption should be made about trustworthiness purely from whether an image uses them.
The IPTC "Digital Source Type" field
IPTC, the body behind the photo metadata fields news agencies use, keeps a list of values for a field called Digital Source Type. Two of them matter here: trainedAlgorithmicMedia, named "Created using Generative AI", and compositeWithTrainedAlgorithmicMedia, named "Edited using Generative AI".
Some generators and editing tools fill in this field. When it says one of those values, it is a direct statement from the software. But on its own, outside a signed credential, it is just text: any editor can write it, change it or delete it.
Software names and descriptions
The oldest clue is the plainest. Many programs write their name into a "Software" or "Creator tool" field, and some generators put their name or the prompt into a description or credit field. A file that says it was made by an image generator probably was. A file that says "iPhone" in the camera field might have been, or someone might have typed it in.
What the checker on this site does, and does not do
The photo metadata checker reads EXIF, XMP, IPTC and GPS data with an open-source library, and runs two provenance checks:
- Content Credentials marker. In JPEG files it looks for the data section where C2PA credentials are stored and tells you if one is present. It does not verify the signature or show who signed it. For that, use the Verify page linked from the Content Credentials site.
- Generator names. It searches the software, description, credit and source fields for names such as DALL·E, Midjourney, Stable Diffusion, Adobe Firefly, Imagen and OpenAI, and flags a match.
It does not look at the pixels. It cannot tell a generated face from a real one by how it looks, and it makes no guess when the labels are missing. If it finds nothing, the right reading is "no label", not "real photo".
The same tool also removes metadata, and that includes Content Credentials. That is good for privacy when you share your own photos, and it is also a live demonstration of the main limit: a few seconds is all it takes to make a labelled image unlabelled. To see the full list of fields a photo can carry, see how to see a photo's metadata.
Proof from the camera side
The strongest evidence that a photo is real comes from the device that took it, recorded at the moment of capture. Apple's Reference Image feature on iPhone 18 Pro models is one example: in Reference mode, the iPhone captures signed data from the main camera sensor along with the photo. Apple's support article says that after the reference image is developed, you can compare it with the photo to see edits such as a crop, a color adjustment or an adjustment made with generative AI. It only exists for photos taken that way, and only if the person sharing chooses to include it.
Practical checks when it matters
If a photo is evidence for something, a damaged car, a receipt for a refund or a document someone sent you, metadata is one input among several:
- Read the metadata with the checker. A generator name or a C2PA marker is worth following up.
- Verify any credential on the Content Credentials Verify page.
- Ask for the original file, not a screenshot or a forwarded copy. Originals keep more of their data.
- Look for a second source: another photo from a different angle, a video, or the paper original.
For insurance, the car accident claim checklist covers what adjusters usually want alongside photos. For receipts you keep for returns or taxes, the best way to store receipts digitally explains how to keep the originals, and sharing documents securely from an iPhone covers sending them without extra data you did not mean to include.
Based on the C2PA FAQ and Specification 2.2 explainer, the IPTC Digital Source Type vocabulary and Apple Support, as published in October 2026. Provenance tools are changing quickly; check the C2PA site for the current state.