Proving a photo is real

Remember the picture of the Pope in a huge white puffer jacket? It went everywhere. People shared it, laughed at it, and a lot of them believed it. It was made with an AI image generator. Nobody took that photo, because there was no photo.

Tools have improved since then. Now you can type a sentence and get an image that looks like it came out of a real camera. Hands are fine now. Text is fine. Light and shadows are convincing.

As someone who takes photos, this worries me in a specific way. Not that people will make fake images, that was always possible. It's that people will stop believing real ones.

Spotting fakes is a losing game

For a while, the advice was: look for six fingers, weird earrings, melted text in the background. That advice is already out of date. Every time someone finds a tell, the next model fixes it.

AI detection tools have the same problem. They guess, they get it wrong, and they will always be one step behind. So the smarter people in this space flipped the question. Instead of asking "is this fake?", ask "can this prove it's real?"

You can't catch every fake. But you can give real photos a way to prove themselves.

Content Credentials, explained simply

The idea is called content provenance, and the most important standard for it comes from a group called the C2PA, the Coalition for Content Provenance and Authenticity. It was started in 2021 by companies including Adobe, Microsoft, Intel, Arm, the BBC and Truepic. The friendly name for what they built is Content Credentials.

Think of it as a nutrition label for a photo, with a tamper-proof seal.

When a supported camera takes a picture, it attaches a small record: this image was captured by a camera, at this time, and here is a cryptographic signature to prove it. When you edit the photo in a supported app, the app adds its own entry: exposure changed, cropped, this part was generated with AI. Each step is signed. If anyone changes the image without updating the record, the signature breaks, and anyone checking can see it.

It doesn't say whether a photo is "true". A real photo can still be misleading. But it tells you where the image came from and what happened to it along the way. That's a lot more than we have now.

Who's actually using it

This isn't just a white paper anymore. Leica released the first camera with Content Credentials built in, back in 2023. Sony, Nikon and Canon have all started adding support to some of their professional models, mostly aimed at news photographers. Recent phones from Google and Samsung have started adding credentials too, at least to some photos and to images edited with their AI tools.

On the software side, Adobe's apps can attach credentials when you export, and Adobe's own image generator marks its output as AI-made. OpenAI adds credentials to images made by its generators. Google also uses its own invisible watermark, SynthID, for AI images.

And you can check an image yourself. There's a free tool at contentcredentials.org/verify. Drop an image in, and if it has credentials, it shows you the history.

The catch: credentials are easy to lose

Here's the honest problem. Content Credentials live in the file's metadata. Take a screenshot, and they're gone. Upload to many social media sites, and they get stripped when the image is compressed. Send it through a chat app, often the same.

So right now, a photo without credentials proves nothing. It might be fake, or it might be a perfectly real photo that lost its label on the way. The system only becomes really powerful when the big platforms keep the credentials and show them to you. Some have started: LinkedIn shows a small label on images that carry them, and others show "AI info" tags. It's progress, but slow.

Invisible watermarks, hidden in the pixels themselves, help with this, because they can survive a screenshot. Combining the two, a signed record plus a watermark that points back to it, is where things seem to be heading.

The privacy question

There's a tension here that I feel personally. When I put photos on this website, I deliberately remove the location data hidden in the files. Nobody needs to know exactly where I was standing, or where I live.

A credential that proves a photo is real could, if you're not careful, also reveal who took it and where. The standard lets you choose what to include. You can sign a photo as yours without publishing your GPS location. For a journalist in a dangerous place, that choice matters a lot. For the rest of us, it's worth checking the settings before switching it on.

What this means for photographers like me

Honestly, my cameras don't support this yet, and neither do the photos on this site. But I think in a few years it will be normal, the way the little padlock in your browser became normal for websites. You won't think about it. You'll just notice when it's missing.

For news photos, evidence and anything important, I think we'll slowly learn to ask: where did this come from? Does it have credentials? And for everything else, maybe a healthy habit: before you share the shocking picture, take five seconds and wonder whether anyone actually took it.

My take: we can't stop fake photos. But we can make real ones easier to trust.

— Desly