ChatGPT image watermark detector

Readers arrive asking whether an image was made by ChatGPT. The check cannot answer that. What it can do is examine one file and report which provenance signals are present in it. Those are different propositions, and the distance between them is where almost every misreading of a detector result lives.

Operationally the file uploads into our media workflow, where the examination runs; JPEG, PNG and WebP are accepted. What matters is what a reader is entitled to conclude from what comes back.

Provenance for generated images is built in two layers because no single layer has the properties you would want. The first is a C2PA Content Credential: a cryptographically signed manifest in the file container recording the tool that produced the file, when, and what has been done to it since. OpenAI joined the C2PA steering committee in May 2026. The signature is the point: a later modification does not silently rewrite the record, it breaks it.

The second layer is an invisible watermark in the pixel data. SynthID, Google DeepMind's system, is the canonical example. It is information-poor by comparison, signalling generation and essentially nothing else, and it is not cryptographically verifiable in the way a signed manifest is.

The layers trade off along exactly one axis: richness against durability. The manifest carries a great deal and is discarded by any operation that rebuilds the container. The pixel watermark carries very little and survives a good deal of that same handling. Neither is redundant, and a checker that reads one is not substituting for the other.

Stated as a procedure, with the provenance of the file treated as part of the procedure rather than as a precondition someone else handles.

Step 1

Establish which artefact you are examining. An original download, an attachment, a platform download and a screenshot are four different objects, and the conclusion a null result supports differs for each.

Step 2

Upload the file in the panel above. The examination runs in our media workflow and reports the signals it reads from that file.

Step 3

Record the finding and the artefact together. A result detached from the file it came from is not a finding, and it will be quoted later as though it were stronger than it was.

A found signal and a missing signal are not opposite results of equal weight, and treating them as though they were is the dominant error in this category. A verified manifest is positive evidence: something specific was present, it parsed, and it says what it says. It is narrow evidence, bearing on one file, but within that scope it is solid.

A null result is the absence of a reading, which is a much weaker object. It is consistent with a human photograph, with a generated image whose container was rebuilt, with a screenshot, with a format conversion, and with a generated image from a tool that writes no signals at all. Five hypotheses survive the null, and only one of them is the one people want to conclude.

A sharper version of the point: a null does not even establish that the file is free of an invisible watermark. Demonstrating absence is materially harder than demonstrating presence, and a checker that simply reports nothing has not demonstrated it. Most pages in this category quietly elide the distinction.

The most useful reframing available here is that a manifest check is a custody question rather than a forensic one. You are not interrogating the picture. You are asking whether a record attached to this particular container has survived the path the container took to reach you.

That makes the failure modes predictable rather than surprising. A screenshot returns nothing because it is a new file assembled from display output, and a new file inherits no container metadata. A platform download returns nothing because ingest transcoding produces a re-encoded derivative. An editor export returns nothing unless that editor preserves credentials. None of these are detection failures. They are custody breaks, visible in the history of the file rather than in its pixels.

It also tells you where effort pays. One request to a source for the original download changes the evidentiary position more than any amount of re-analysis of a degraded copy.

Provenance signalling is designed for a cooperative case: an honest publisher wants downstream readers to know what a file is. Against a party who does not, the design has obvious limits, and stating them is more useful than pretending otherwise.

Stripping a container manifest is trivial and needs no special knowledge, since any re-encode achieves it as a side effect. The pixel layer raises the cost, but compression, cropping and rescaling all degrade it, and anyone willing to accept quality loss has a straightforward path. Relying on these signals to catch deliberate deception is relying on the wrong instrument.

Their real utility is elsewhere and is genuine: they resolve the common case, an unmodified file passed along by someone with no intent to conceal anything, at almost no cost. Used for that they are excellent. Used as a fraud control they are weak, and no detector page should imply otherwise.

One layer can be corroborated and one cannot. C2PA is a published format, so independent inspectors parse the same manifest, some locally in the browser through WebAssembly, with the file never leaving the machine. c2paviewer.com is one such reader. A claim about a manifest is therefore falsifiable by a third party, which is the property that makes it worth anything.

The pixel layer has no equivalent. Reliable detection needs the originating vendor's detector, and SynthID verification is offered inside Google's Gemini app rather than as an open specification. This page makes no claim to confirm a SynthID watermark, and a non-vendor page that does is asserting something it cannot demonstrate.

No, and nothing in this category does. What is on offer is evidence about a file, of a known kind, with known failure modes. Treating that as a verdict is a category error that the marketing in this space actively encourages.

The limits worth stating explicitly: no pixel-level SynthID confirmation, because that needs the vendor's own detector. No probability score, because we have measured no accuracy figure we would stand behind. No claim about what every ChatGPT image contains, because that is third-party behaviour which changes without notice. No prediction about what any other checker, including OpenAI's own, will say about a file.

There is no batch queue and no API. Formats are JPEG, PNG and WebP, and no file size cap is published because none is defined for this check. Where a page in this category prints a number, ask where it comes from. An unsourced number is worse than a stated silence.