Quick Answer: Check provenance first, then pixels. Upload the image to a Content Credentials (C2PA) verifier and to a watermark checker: Google's Gemini app checks for Google's SynthID watermark and reads Content Credentials, and OpenAI's verify page checks for OpenAI's own signals. A positive result is strong evidence. A negative result proves nothing, because screenshots and re-uploads strip metadata and most generators are not covered by any one checker. Then run a reverse image search to find the earliest copy, inspect the image for physical inconsistencies (text, hands, reflections, shadows, background geometry), and treat AI detector scores as one weak signal. Reach a verdict only when several independent checks agree.
Provenance checks come first, visual inspection last.
Why This Got Harder
Current image models render hands, skin and lighting well enough that a casual look often fails. Visual inspection still catches plenty, but it now comes last. Provenance signals built into the files come first. Two systems matter:
- Content Credentials, built on the open C2PA standard, attach a signed record of who made a file and how it was edited.
- Invisible watermarks, such as Google DeepMind's SynthID, embed a signal directly into the pixels.
Neither covers every image, and both can be lost. Used together with reverse search and careful looking, they give you a reliable method.
Step 1: Check Content Credentials (C2PA)
Content Credentials are a cryptographically signed manifest stored with the image. The Coalition for Content Provenance and Authenticity (C2PA) maintains the standard at c2pa.org. A manifest can say which tool created the file, when, and what edits followed, including whether AI was used.
They are used for real photos too. Google's Pixel 10 phones, for example, add Content Credentials to JPEG photos taken in Pixel Camera, and Google Photos records AI and non-AI edits. So a credential is not an "AI label." It is a history, and you read what it says.
How to check:
- Upload the file to a C2PA verifier. The Content Authenticity Initiative runs a free open-source Verify page, and there are browser-based viewers that process the file locally.
- In the Gemini app (web and Android), upload the image and ask "Is this AI-generated?" Google says Gemini shows which company signed the credentials and summarizes composition, edit history and AI use.
- For bulk or offline work, the open-source c2patool command-line tool reads and validates manifests.
How to read the result:
| Result | What it means |
|---|---|
Valid manifest naming an AI generator | Strong evidence the image was generated or edited with that tool |
Valid manifest from a camera, no AI steps | Strong evidence of a camera capture, though check the edit list |
Manifest present but invalid or modified | The file was changed after signing. Treat with suspicion |
No manifest | Tells you nothing. Most images online carry none |
The last row is the one people get wrong. OpenAI's own help center notes that Content Credentials can be lost through everyday actions such as taking a screenshot or converting a file. Social platforms often strip metadata on upload. Absence of credentials is the normal state of an image on the internet.
Step 2: Check for Invisible Watermarks (SynthID and Others)
Watermarks survive where metadata does not, because the signal lives in the pixels. Two checks are available to the public today.
Google's SynthID via Gemini. Signed in at gemini.google.com or in the Gemini app, upload one image (100 MB or less) and ask whether it is AI-generated, or whether it contains SynthID. Google's help page states the current limits plainly:
- It can only recognize content made or edited with Google AI tools, even though other companies are adopting SynthID.
- No SynthID detection does not rule out other AI systems.
- Results can be unclear for very simple or abstract images, or for minor edits.
- The watermark usually survives resizing, recoloring and compression, but may not survive heavy alteration.
- Screenshots should be tightly cropped, and collages are not supported.
- There is a quota of roughly 10 image checks per rolling 24 hours.
OpenAI's verify page. OpenAI says images generated with ChatGPT, Codex or the OpenAI API now carry both Content Credentials and a SynthID watermark. Its public verify page at openai.com/verify checks an uploaded image for a SynthID watermark or a trusted C2PA manifest associated with OpenAI. OpenAI also notes that coverage varies by product, model and export path, and that some older API image models slated for deprecation are not covered. It says heavy cropping or compression can make a watermark undetectable.
What this means in practice: each vendor checker answers one narrow question, "did our tools make this?" A "yes" from either is close to conclusive. A "no" only rules out that vendor. Run both, since they cover the two largest consumer image generators, and remember that images from other models and open-source tools may carry no watermark at all.
How each signal holds up once an image has been compressed, screenshotted, re-uploaded or edited, per the vendor documentation cited above.
Step 3: Read the Ordinary Metadata
Before C2PA, there was plain XMP and EXIF metadata, and it still helps. The IPTC photo metadata standard defines a "Digital Source Type" field, and IPTC recommends that AI image software write the value trainedAlgorithmicMedia into it. Related values include compositeWithTrainedAlgorithmicMedia for real photos altered by AI inpainting or outpainting.
Open the file in a metadata viewer (exiftool is the standard free tool, and most photo editors have a file info panel) and look for:
- A Digital Source Type value mentioning algorithmic or synthetic media
- A "Software" or "Creator Tool" field naming an image generator
- Camera fields (make, model, lens, exposure) that are present and consistent, or conspicuously empty
Metadata is easy to edit and easy to strip, so it can confirm a suspicion but cannot clear an image.
Step 4: Run a Reverse Image Search
Provenance tools tell you how a file was made. Reverse search tells you where it came from, which often settles the question faster.
Search the image in Google Lens, Bing Visual Search and TinEye (they index different parts of the web, so use more than one). Then:
- Sort by oldest. The earliest copy is usually closest to the source. An "eyewitness photo" that first appeared on an AI art forum two days before the event it supposedly shows is answered.
- Find the uploader. Many AI images trace back to an account that posts AI art openly, sometimes with the prompt.
- Look for the uncropped or higher-resolution original. Viral copies are often cropped to remove a generator's visible label or a caption saying "made with AI."
- Search key frames separately. If the image is a collage or a screenshot of a post, crop the photo itself and search that.
- Check whether a photo agency or news outlet has it. A real news photo usually has a credited photographer and appears across wire services.
Reverse search also exposes AI edits: an original that matches except for one changed element shows you the manipulation.
Step 5: Inspect the Image Itself
When provenance and search come up empty, you are back to looking. Zoom in to 100 percent or more and work through these areas. Look for physical logic, not for "AI style."
Where to look first: text, hands and accessories, shadows, reflections, background geometry and context.
Text and Symbols
Text remains one of the more reliable tells. Check signs, labels, license plates, book spines, jersey numbers and screen content. Watch for letters that drift into shapes, words that are almost real, logos that are close to a real brand but wrong, and text that changes style mid-word. Newer models render headline text well, so focus on small background text, where errors persist longer.
Hands, Teeth, Ears and Accessories
Fingers are much better than they were, but check how hands interact with objects: a grip that passes through a cup handle, a ring merging into skin, a strap that ends nowhere. Earrings that do not match, glasses whose arms vanish into hair, and teeth that blend into a single band are common.
Lighting, Shadows and Reflections
Real light has one set of rules. Check that shadows fall in the same direction for every object, that a bright window actually lights the side of the face facing it, and that reflections in mirrors, sunglasses, eyes and water show what should be there. A reflection showing a different pose, a missing reflection, or a shadow attached to nothing is a strong sign.
Backgrounds and Geometry
Generators spend their detail on the subject. In the background, look for railings that merge, windows with inconsistent spacing, buildings whose lines do not converge correctly, crowds where faces dissolve into smears, and repeating patterns (tiles, bricks, leaves) that subtly warp. Straight lines that bend for no optical reason deserve a second look.
Context
Does the weather match the reported date and place? Are the uniforms, vehicles and street signs right for the country? Context errors are invisible to pixel analysis and often obvious to a human.
Step 6: Use AI Image Detectors Carefully
AI image detectors are classifiers trained on real and generated images that return a probability an image is synthetic. Use them to screen, not to decide.
Their known weaknesses:
- Unseen generators. A detector trained on older models can miss images from a newer one.
- Compression and resizing. Images passed through social platforms and messaging apps lose the fine detail detectors rely on. In a 2023 test by the investigative group Bellingcat, one popular detector labeled compressed AI images as human-made.
- False positives on real photos. Heavy editing, noise reduction, upscaling and smartphone computational processing can all push a real photo toward an "AI" score.
- Partial edits. A real photo with one AI-altered region is hard for a whole-image classifier, because most of the pixels are genuine.
- Vendor benchmarks. Accuracy figures published by detector vendors are measured on their own test sets, which may not resemble the image in front of you.
Run the best copy you have through two or three detectors, treat disagreement as "unknown," and never accuse anyone of faking an image on a detector score alone.
The Checklist
Use this in order. Stop when you have a confident answer from independent sources.
The verification workflow: a positive provenance signal is strong, a negative one proves nothing.
| # | Check | Conclusive if | Inconclusive if |
|---|---|---|---|
1 | Find the best copy (largest, earliest, uncropped) | n/a | Only screenshots exist |
2 | Content Credentials verifier | Valid manifest names an AI tool or a camera | No manifest found |
3 | Gemini SynthID check | SynthID detected | Not detected |
4 | OpenAI verify page | OpenAI signal found | Not found |
5 | Metadata viewer | Digital Source Type or generator named | Fields empty |
6 | Reverse image search, sorted oldest | Source is an AI art account or a prompt post | No earlier copies |
7 | Visual inspection | Clear physical impossibility | Only "it looks too polished" |
8 | AI detectors | Never conclusive alone | Disagreement between tools |
9 | Context check | Scene contradicts known facts | Plausible but unconfirmed |
If you reach the bottom without a conclusive row, the honest answer is "unverified." That is a legitimate result, and saying it is better than guessing.
Frequently Asked Questions
Is there a single free tool that tells me if any image is AI?
No. Each provenance checker covers specific vendors or specific signals. Gemini detects Google's SynthID and reads Content Credentials, and OpenAI's verify page detects OpenAI's signals. General AI image detectors cover any image but give probabilities with real error rates. Combining several checks is the only dependable approach.
What is SynthID and can I check it myself?
SynthID is an invisible watermark developed by Google DeepMind that is embedded in the pixels of generated content. You can check images for it by uploading them to the Gemini app while signed in and asking whether the image is AI-generated. Google says Gemini currently recognizes only content made with Google AI tools, and there is a daily quota of about 10 image checks.
What are C2PA Content Credentials?
Content Credentials are signed records attached to a file that describe its origin and edit history, built on the open C2PA standard. AI generators, cameras, phones and editing software can write them. You read them with a Content Credentials verifier. They are lost easily through screenshots, format conversion and many social platform uploads.
If an image has no metadata or watermark, is it real?
Not necessarily. Most images online have no credentials at all, because their metadata was stripped or the tool that made them never added any. Missing provenance means you need to rely on reverse image search, visual inspection and context instead.
Why did an AI detector flag my real photo?
Detectors look for statistical patterns, and editing can create similar patterns. Strong noise reduction, upscaling, beauty filters, heavy compression and some phone camera processing can all raise an AI score on a genuine photo. If you need to prove a photo is real, keep the original file from the camera, and use a device that writes Content Credentials at capture where possible.