Apple just added Reference Image to the iPhone 18 Pro, a system-level photo authenticity marker that signs images at capture time using the C2PA standard. That is a nice signal for the phones that carry it, but most photos in the world do not. If you are an editor, a fact-checker, or someone who publishes work and needs to know whether an image was edited, you need a desktop tool that reads the signal and inspects the pixels.
We pulled together eight apps that verify photo authenticity from different angles. Some read C2PA credentials. Some inspect JPEG structure to spot re-saves. Some run error-level analysis on the pixels to reveal composite work.
What to look for in a photo authenticity tool
The right stack depends on what you are checking.
- C2PA / Content Credentials support to read manifests where they exist
- EXIF, IPTC, XMP, and MakerNote parsing for camera provenance
- Error Level Analysis (ELA) and clone detection for forgery hunting
- JPEG structure and quantisation table inspection to spot re-saves
- Reverse image search integration to find prior copies
- No network calls, or clear separation of the ones that do
Quick comparison
| App | Best for | Platforms | License | Starting price |
|---|---|---|---|---|
| ExifTool | Reading every metadata field | Windows, macOS, Linux | Open-source | Free |
| c2patool | Verifying C2PA / Content Credentials | Windows, macOS, Linux | Open-source | Free |
| Adobe Content Credentials | Signing and reading in the Adobe stack | Windows, macOS | Proprietary | Included with Adobe |
| Truepic Lens | Signed capture and verification | Windows, macOS | Proprietary | Paid |
| FotoForensics | Web-based ELA and metadata | Web (with local option) | Proprietary | Free tier, paid API |
| Forensically | Browser-side ELA, clone, geo | Web, browser-based | Free | Free |
| JPEGsnoop | Deep JPEG structure inspection | Windows | Open-source | Free |
| Amped Authenticate | Law-enforcement grade forensic suite | Windows | Proprietary | Paid |
1. ExifTool — best for reading every metadata field
ExifTool is the reference implementation for image metadata. It reads EXIF, IPTC, XMP, ICC, and most camera-specific MakerNote formats, including the ones Sony, Nikon, and Fujifilm bury under proprietary tags. It runs on the command line and does not touch the network. Every other tool in this list will use ExifTool output at some point.
Where it falls short: No GUI in the base tool. GUI wrappers exist but they lag the command line.
Pricing: Free, open source.
Platforms: Windows, macOS, Linux.
Download: ExifTool website · GitHub
Bottom line: The first tool to reach for. If a claim depends on metadata, run ExifTool.
2. c2patool — best for reading Content Credentials
c2patool, from the Content Authenticity Initiative, is the reference tool for reading and writing C2PA manifests. Feed it an image and it will surface the signed capture claim, the edit history if any downstream tool respected the standard, and the signing certificate chain. It is a CLI with straightforward JSON output.
Where it falls short: Only useful on files that were signed. A stripped or re-saved photo has nothing to read.
Pricing: Free, open source (Apache 2.0).
Platforms: Windows, macOS, Linux.
Download: c2patool on GitHub
Bottom line: The essential companion to any camera or platform that signs images with C2PA.
3. Adobe Content Credentials — best inside the Adobe workflow
Adobe Content Credentials ships inside Photoshop, Lightroom, and Firefly. It lets you sign edits, keep a chain of edit history, and read credentials on incoming files. If your team is already on Creative Cloud, the friction to turn it on is close to zero.
Where it falls short: Only meaningful when the source photo was already signed, and reach outside the Adobe ecosystem is limited.
Pricing: Included with Creative Cloud plans.
Platforms: Windows, macOS.
Download: Content Credentials website
Bottom line: The pick if your workflow already lives in Adobe apps.
4. Truepic Lens — best signed-capture app
Truepic Lens takes a different approach: it captures new photos with a hardware-attested C2PA signature so downstream verifiers can confirm the image came from a real camera on a real device at a real time. The desktop verifier and enterprise SDK complete the loop.
Where it falls short: It solves the capture side of the problem, not “here is a photo someone sent me, is it real.”
Pricing: Paid, with enterprise plans.
Platforms: Windows, macOS.
Download: Truepic website
Bottom line: Pick this when you need to prove your own photos are authentic to a third party.
5. FotoForensics — best web-first ELA workbench
FotoForensics offers Error Level Analysis, metadata parsing, and JPEG quantisation tables in a browser tab. Uploads are analysed server-side, which is fine for public samples and not fine for sensitive material. A paid API tier is available for teams.
Where it falls short: Web-hosted. Do not upload confidential images.
Pricing: Free tier with public library, paid API.
Platforms: Web, browser-based.
Download: FotoForensics website
Bottom line: Quick first pass on public photos when you need ELA in 30 seconds.
6. Forensically — best browser-side inspector
Forensically does what FotoForensics does but runs entirely in your browser. Uploads never leave your machine. It offers ELA, magnifier, clone detector, noise analysis, and a geolocation overlay from EXIF.
Where it falls short: No API, no scripting. It is a single-image tool.
Pricing: Free.
Platforms: Web, browser-based.
Download: Forensically website
Bottom line: The pick when you want ELA on a sensitive image without uploading it to a third party.
7. JPEGsnoop — best JPEG structure inspector
JPEGsnoop breaks a JPEG open and shows every marker, quantisation table, and Huffman table inside. That sounds arcane, but it is exactly what surfaces re-saves: a camera JPEG has a distinctive quantisation signature, and Photoshop overwrites it. JPEGsnoop tells you which processing chain produced the file you are looking at.
Where it falls short: Windows only. Development slowed in the last few years, though the core is still solid.
Pricing: Free, open source.
Platforms: Windows.
Download: JPEGsnoop on GitHub
Bottom line: The pick when you want to know what edited a JPEG, not just whether it was edited.
8. Amped Authenticate — best professional forensic suite
Amped Authenticate is the tool most digital forensics labs use. It bundles roughly 30 filters (ELA, clone search, PRNU noise analysis, JPEG traces, motion trails) plus reporting output that stands up in court proceedings. It is Windows-only and expensive.
Where it falls short: Priced for law enforcement and enterprise. Overkill for a newsroom fact-check.
Pricing: Paid, quote-based.
Platforms: Windows.
Download: Amped Software website
Bottom line: The pick when your report will end up in front of a court and needs to hold up.
How to pick the right one
- If you want to know what the file claims to be: ExifTool, then c2patool if a manifest is present.
- If you edit in Adobe and want to preserve provenance: Content Credentials.
- If you need to sign your own photos at capture: Truepic Lens.
- If you want to spot composite work in a hurry: Forensically for privacy, FotoForensics for the public tools.
- If a JPEG’s history matters: JPEGsnoop.
- If a court report is the deliverable: Amped Authenticate.
Most working stacks in 2026 look like ExifTool plus c2patool plus one ELA tool. Anything beyond that is for people whose job title includes “forensics.”
FAQ
How do I verify a photo is real?
Read the metadata with ExifTool, check for a C2PA manifest with c2patool, and run Error Level Analysis with Forensically or FotoForensics. If all three agree the file is what it claims to be, it probably is. If any disagree, dig deeper.
What are Content Credentials?
Content Credentials are the consumer name for C2PA-signed metadata that records where an image came from and what changed it. Apple, Adobe, Leica, Sony, Nikon, and a growing list of camera and software vendors support it.
Is stripped metadata proof of tampering?
No. Many social platforms strip metadata on upload for privacy reasons, so a photo with no EXIF is not automatically suspicious. It just means you cannot use metadata to verify it, and you have to fall back to the pixels.
Can AI-generated images be detected?
Sometimes, and less reliably every quarter. Detectors improve, generators improve faster. C2PA signatures on captured photos are more reliable than trying to detect AI output after the fact.
What is the best free photo forensics app?
ExifTool for metadata, c2patool for C2PA, Forensically for browser-side ELA. Together they cover most of what a newsroom or fact-checker needs without a budget.
