Loading page
About this tool
Inspect bounded local JPEG, PNG, BMFF, and standalone JUMBF files for observable C2PA container structure without claiming cryptographic verification or authenticity.
The C2PA Content Credentials Structure Inspector reads a file's C2PA Content Credentials container structure locally — the JPEG APP11 JUMBF fragments, the PNG caBX chunk, the BMFF uuid box carrying UUID d8fec3d6-1b0e-483c-9297-5828877ec481, or a standalone .c2pa store — and reports what JUMBF boxes are actually present. It walks the box tree, matches the C2PA UUIDs for the manifest store, standard and update manifests, assertion store, claim and signature, and counts them. It deliberately stops at structure: no COSE signature is verified, no CBOR claim is decoded, no trust list is consulted, so it tells you what shape the credential data is in, never whether it is authentic.
Open C2PA Content Credentials Structure Inspector on AltFTool — it loads instantly in your browser.
Pick a file under "Local media or manifest" — JPEG, PNG, MP4, M4A, MOV, AVIF, HEIC, HEIF or .c2pa, maximum 24 MB.
Press "Inspect structure" to walk the JUMBF box tree and match the C2PA UUIDs for manifest stores, assertion stores, claim boxes and claim-signature boxes.
Read the per-box tallies, then use "Export counts only" to download c2pa-structure-counts.json, which omits the filename, media bytes and claim values.
JPEG APP11 fragment sequences, PNG caBX chunks, BMFF uuid boxes and bare .c2pa JUMBF stores are all parsed, including fragment ordering and orphan detection.
You get separate tallies for standard manifests, legacy manifests, update manifests, assertion stores, claim boxes, signature boxes and compressed content boxes, plus the box depth reached.
Every result carries explicit flags marking signature verification, asset binding, trust-list evaluation, signer identity, edit history and AI-use determination as not performed.
No. It reports container structure only, and a readable C2PA-shaped store establishes nothing about authenticity, integrity, signer identity, edit history or whether AI was involved. The result explicitly records cryptographicSignatureVerified, assetBindingVerified, trustListEvaluated and aiUseDetermined as false — use a full C2PA validator for those questions.
Only that no embedded store was observed in the bytes it parsed. Credentials may never have been added, may have been stripped by an editor or upload pipeline, may live in an external or sidecar manifest that is not fetched here, or may use an embedding this inspector does not support. Absence is not evidence of tampering.
JPEG, PNG, MP4, M4A, MOV, AVIF, HEIC, HEIF and .c2pa files, up to 24 MB, with the manifest store itself bounded at 8 MB. Parsing is capped at 4096 JUMBF boxes, 16 levels of nesting, 512 JPEG segments and 2048 PNG chunks so a malformed file cannot stall the page.
No, and the exportable report is counts-only by design. It omits the filename, the media bytes, the raw manifest, any claim or assertion values, and arbitrary labels — it carries only file size, container format and structural tallies under the schema altftool.c2pa-structure-counts.v1.