Watermark is a local-first web application for inspecting C2PA Content Credentials and understanding media provenance. The first release verifies media in the browser, computes a SHA-256 digest, distinguishes valid signatures from trusted issuers, and displays manifest lineage without uploading the asset.
- Drag-and-drop image, audio, and video inspection
- C2PA manifest discovery and verification through
@contentauth/c2pa-web - Signature algorithm, issuer, claim generator, ingredients, assertions, and validation codes
- File size, MIME type, and SHA-256 display
- Explicit handling for missing, invalid, untrusted, and unsupported credentials
- Browser-only processing with no application backend
npm install
npm run devVite serves the app at http://localhost:5173.
npm run build
npm run typecheck
npm testsrc/App.tsxcontains the drop zone, preview, and result views.src/lib/c2pa.tsowns SDK initialization and file verification.src/lib/verification.tsnormalizes SDK manifest data into a stable UI model.src/lib/file.tscontains MIME detection, byte formatting, and SHA-256 utilities.src/lib/types.tsdefines the application verification contract.
The C2PA SDK runs in a Web Worker with its WASM binary loaded as a Vite asset. The app does not currently create or re-sign manifests; editing and signing require a separate key-management and provenance update design.
A trusted C2PA result means the SDK validated the manifest signature, content binding, and issuer trust policy available to the application. It does not prove that every statement in the manifest is true. A missing manifest does not establish that content is human-made or AI-generated.
- Privacy-safe metadata sanitizer with an explicit field allowlist.
- Provenance-aware crop, resize, and compression workflow.
- Local lineage dashboard backed by IndexedDB.
- AI-detection appeal evidence export.
- Educational views for C2PA, SynthID, statistical watermarking, and steganalysis.
MIT. See LICENSE.