How Reconize checks a file
Reconize reads the Content Credentials inside a file and tells you who signed it, whether it has changed since, and how much of that can be confirmed. This page explains what it checks, which lists it trusts, and what a result does not tell you.
Where the check runs
On your device. The Reconize app for Mac, reconize.me/verify and the Reconize browser extension all read the file locally. Nothing is uploaded. All three use the same open-source C2PA library and the same trust lists, so the same file gets the same answer everywhere.
The one thing the browser tools cannot do is read Reconize's invisible watermark. That runs only in the Mac app.
What gets checked
- The signature. The credentials are signed with a certificate. We check the signature is valid and whether the certificate chains to the C2PA trust list.
- The content. The credentials carry a fingerprint (hash) of the file's content. If the content no longer matches, the file changed after signing.
- The time. A signature can carry a time stamp from an independent time-stamp authority. We check it against the C2PA time-stamp authority list.
- The name. A signer can attach an identity: an identity certificate, or an identity credential issued by Reconize. We check each against its own list, separately from the signature.
What each result means
- Credentials valid
- The signature is valid, the signer's certificate is on the C2PA trust list, and the content has not changed since signing.
- Signer not trusted
- The signature is valid and the content is unchanged, but the signer's certificate is not on the C2PA trust list. The file is intact; we just cannot say who stands behind the certificate.
- Changed after signing
- The content no longer matches what was signed. Something was edited, or the credentials were copied onto a different file.
- Name withdrawn
- The signature is fine, but the identity credential that named the signer has been withdrawn by its issuer. The name is shown struck through.
- No credentials found
- The file carries no Content Credentials. This is common: many sites and apps strip them when you upload. It does not mean the file is fake.
- Could not check
- The file could not be read, for example a video that streams in pieces with no single file to open. No verdict is given.
Name confirmed
A name is shown as Name confirmed only when an identity certificate chains to the lists below, or when an identity credential from Reconize checks out and has not been withdrawn. Otherwise it reads Name not confirmed, and any name in the file is shown as stated by the signer.
The trust lists
Reconize ships fixed copies of these lists with the app, the website and the extension, and updates them with each release.
| List | Used for | Certificates | Our copy |
|---|---|---|---|
| C2PA trust list | Who signed the credentials | 49 | Sep 23, 2026 |
| C2PA time-stamp authority list | Whether a time stamp is trusted | 21 | Aug 21, 2026 |
| CAWG interim trust anchors | Identity certificates: Mozilla email roots plus IPTC anchors | 91 | Sep 13, 2026 |
| IPTC Origin Verified News Publishers | Identity certificates of listed news publishers | 20 | Sep 13, 2026 |
Time
If the signature carries a time stamp from an authority on the C2PA time-stamp list, the result says Signed no later than that time, marked trusted time. Without one, the signing time is only what the signer's software recorded, and we say so.
Revocation
Certificates can be revoked by the authority that issued them. Reconize counts a revocation when the file carries the revocation response itself. It does not contact certificate authorities at check time, so a certificate revoked after signing can still read as not revoked.
Identity credentials issued by Reconize are different: when you check a file, the issuer's public status list is fetched to see whether the credential has been withdrawn. When it cannot be reached, the result says the name could not be checked.
Camera and device keys
Some cameras and phones sign every photo with a key built into the device. Some of these keys have been used in public to sign images the camera never took. When a file is signed with one of them, we add a caution: the signature alone does not prove the device took the picture.
When a site shows its own credentials pin
Some platforms read the credentials when you upload, show their own pin, then serve a copy with the credentials removed. Reconize reads the copy you are looking at, so it can say no credentials found next to the platform's pin. Both are true. When the browser extension sees the pin, it says so on the result.
What a check does not tell you
- Whether the content is true, or shows what it claims to show.
- Whether a person, and not software, made it. A signature says who signed, not who made it.
- Anything about the file before it was signed.
- That a file without credentials is fake, or made with AI.
- That a trusted signer is a good actor. A trust list says a certificate authority checked the signer, not that the signer is honest.
Questions
If a result looks wrong, send the file and what you expected to hello@reconize.me. Security and conformance reports: see Security.