How to check an image for Content Credentials with c2patool (two commands)
If you want to know whether a file carries a C2PA manifest, and what it says, the open-source command line tool c2patool from the Content Authenticity Initiative does it without uploading anything.
Install
On macOS: brew install c2patool. On Windows or Linux, download the release archive for your platform from the c2pa-rs releases page (filter for c2patool), extract it, and put the executable on your PATH. Check with:
c2patool -V
Read a file
c2patool image.jpg
By default it prints a JSON summary of the manifests to standard output. If the image has none, it tells you so. Useful variants from the project's docs:
c2patool image.jpg -dfor a detailed, low-level reportc2patool image.jpg --infofor a short validation summaryc2patool image.jpg --output ./reportto write the manifest data and thumbnails to a folder
Reading the output
Look for:
active_manifest: the most recent manifest.- Under assertions, the actions list (for example created or edited), and the
digitalSourceTypeof a generative action. signature_info: who signed it, and when.validation_status: an entry here means something failed, such as a modified file or an untrusted certificate. An empty list isn't a guarantee of truth, it just means the signature checks out.
What a "no manifest" result means
It means this file doesn't carry one. It does not mean a person made the image. Screenshots, social media re-encodes and many editors drop manifests. Likewise a manifest saying AI was used is the signer's statement about the file, not an independent detection.
A scripting-free check
If you'd rather not install anything, Remove AI Meta runs in the browser, reads the container locally and lists the C2PA row plus EXIF and AI text fields. It can also strip them, and the free run covers one image. Use c2patool when you need the full manifest details; use the browser tool for a quick look.
Not affiliated with the CAI or C2PA. Commands are taken from the c2patool documentation.